https://github.com/blackbird-cloud/terraform-azurerm-key-vault

Terraform module to create an Azure Key Vault
https://github.com/blackbird-cloud/terraform-azurerm-key-vault

azure key-vault terraform

Last synced: 4 months ago
JSON representation

Terraform module to create an Azure Key Vault

Host: GitHub
URL: https://github.com/blackbird-cloud/terraform-azurerm-key-vault
Owner: blackbird-cloud
License: apache-2.0
Created: 2024-02-07T09:51:17.000Z (over 2 years ago)
Default Branch: main
Last Pushed: 2025-01-31T14:49:56.000Z (over 1 year ago)
Last Synced: 2025-01-31T15:20:36.441Z (over 1 year ago)
Topics: azure, key-vault, terraform
Language: HCL
Homepage:
Size: 48.8 KB
Stars: 0
Watchers: 3
Forks: 0
Open Issues: 0
Metadata Files:
- Readme: README.md
- License: LICENSE

Awesome Lists containing this project

README

          
# Terraform Azurerm Key Vault Module

Terraform module to create an Azure Key Vault

[![blackbird-logo](https://raw.githubusercontent.com/blackbird-cloud/terraform-module-template/main/.config/logo_simple.png)](https://blackbird.cloud)

## Example

```hcl

module "azurerm_key_vault" {

  source  = "blackbird-cloud/key-vault/azurerm"

  version = "~> 1"

  name                          = "example-key-vault"

  location                      = "westeurope"

  resource_group_name           = "example-rg"

  soft_delete_retention_days    = 7

  enable_rbac_authorization     = false

  public_network_access_enabled = true

  access_policies = {

    admins = {

      object_id = "uuid"

      key_permissions = [

        "Decrypt",

        "Get",

        "List",

        "Sign",

        "UnwrapKey",

        "Verify",

        "GetRotationPolicy",

      ]

      secret_permissions = [

        "Backup", "Delete", "Get", "List", "Purge", "Recover", "Restore", "Set"

      ]

    }

  }

}

```

## Requirements

| Name | Version |

|------|---------|

|  [terraform](#requirement\_terraform) | >= 1.2 |

|  [azurerm](#requirement\_azurerm) | ~> 3.8 |

## Providers

| Name | Version |

|------|---------|

|  [azurerm](#provider\_azurerm) | ~> 3.8 |

## Resources

| Name | Type |

|------|------|

| [azurerm_key_vault.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) | resource |

| [azurerm_key_vault_key.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key) | resource |

| [azurerm_key_vault_secret.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |

| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |

## Inputs

| Name | Description | Type | Default | Required |

|------|-------------|------|---------|:--------:|

|  [access\_policies](#input\_access\_policies) | (Optional) Manages a Key Vault Access Policy. A list of identities to grant permissions inside the Key Vault. `tenant_id` defaults to the current tenant. | 
map(object({
    object_id               = string
    tenant_id               = optional(string, "")
    application_id          = optional(string, null)
    certificate_permissions = optional(list(string), [])
    key_permissions         = optional(list(string), [])
    secret_permissions      = optional(list(string), [])
    storage_permissions     = optional(list(string), [])
  })) | `{}` | no |

|  [enable\_rbac\_authorization](#input\_enable\_rbac\_authorization) | (Optional) Boolean flag to specify whether Azure Key Vault uses Role Based Access Control (RBAC) for authorization of data actions. | `bool` | `false` | no |

|  [enabled\_for\_deployment](#input\_enabled\_for\_deployment) | (Optional) Boolean flag to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault. | `bool` | `false` | no |

|  [enabled\_for\_disk\_encryption](#input\_enabled\_for\_disk\_encryption) | (Optional) Boolean flag to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys. | `bool` | `false` | no |

|  [enabled\_for\_template\_deployment](#input\_enabled\_for\_template\_deployment) | (Optional) Boolean flag to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault. | `bool` | `false` | no |

|  [keys](#input\_keys) | (Optional) A mapping of keys to create within the Key Vault. | map(object({
    name            = string
    key_type        = string
    key_opts        = list(string)
    key_size        = optional(string)
    curve           = optional(string)
    expiration_date = optional(string)
    not_before_date = optional(string)
    rotation_policy = optional(object({
      time_before_expiry   = optional(string)
      time_after_creation  = optional(string)
      expire_after         = optional(string)
      notify_before_expiry = optional(string)
    }))
  })) | `{}` | no |

|  [location](#input\_location) | (Required) Specifies the supported Azure location where the resource exists. Changing this forces a new resource to be created. | `string` | n/a | yes |

|  [name](#input\_name) | (Required) Specifies the name of the Key Vault. Changing this forces a new resource to be created. The name must be globally unique. If the vault is in a recoverable state then the vault will need to be purged before reusing the name. | `string` | n/a | yes |

|  [network\_acls](#input\_network\_acls) | (Optional) Network rules to apply to key vault. | object({
    bypass                     = string,
    default_action             = string,
    ip_rules                   = list(string),
    virtual_network_subnet_ids = list(string),
  })
 | {
  "bypass": "AzureServices",
  "default_action": "Deny",
  "ip_rules": [],
  "virtual_network_subnet_ids": []
} | no |

|  [public\_network\_access\_enabled](#input\_public\_network\_access\_enabled) | Optional) Whether public network access is allowed for this Key Vault. Defaults to `true`. | `bool` | `true` | no |

|  [purge\_protection\_enabled](#input\_purge\_protection\_enabled) | (Optional) Is Purge Protection enabled for this Key Vault? Defaults to `true`. | `bool` | `true` | no |

|  [resource\_group\_name](#input\_resource\_group\_name) | (Required) The name of the resource group in which to create the Key Vault. Changing this forces a new resource to be created. | `string` | n/a | yes |

|  [secrets](#input\_secrets) | (Optional) A mapping of secrets to create within the Key Vault. | map(object({
    name            = string
    value           = string
    content_type    = optional(string)
    expiration_date = optional(string)
    not_before_date = optional(string)
  })) | `{}` | no |

|  [sku\_name](#input\_sku\_name) | (Optional) The Name of the SKU used for this Key Vault. Possible values are `standard` and `premium`. Defaults to `standard`. | `string` | `"standard"` | no |

|  [soft\_delete\_retention\_days](#input\_soft\_delete\_retention\_days) | (Optional) The number of days that items should be retained for once soft-deleted. This value can be between 7 and 90 (the default) days. | `number` | `90` | no |

|  [tags](#input\_tags) | (Optional) A mapping of tags to assign to the resource. | `map(string)` | `{}` | no |

## Outputs

| Name | Description |

|------|-------------|

|  [keys](#output\_keys) | The keys in the vault |

|  [secrets](#output\_secrets) | The secrets in the vault |

|  [vault](#output\_vault) | The created Key Vault. |

## About

We are [Blackbird Cloud](https://blackbird.cloud), Amsterdam based cloud consultancy, and cloud management service provider. We help companies build secure, cost efficient, and scale-able solutions.

Checkout our other :point\_right: [terraform modules](https://registry.terraform.io/namespaces/blackbird-cloud)

## Copyright

Copyright © 2017-2024 [Blackbird Cloud](https://blackbird.cloud)

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/blackbird-cloud/terraform-azurerm-key-vault

Awesome Lists containing this project

README