-
Notifications
You must be signed in to change notification settings - Fork 168
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #320 from Azure/gb-kvrefactor
KeyVault refactor
- Loading branch information
Showing
23 changed files
with
257 additions
and
165 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| @minLength(2) | ||
| @description('The location to use for the deployment. defaults to Resource Groups location.') | ||
| param location string = resourceGroup().location | ||
|
|
||
| @minLength(3) | ||
| @maxLength(20) | ||
| @description('Used to name all resources') | ||
| param resourceName string | ||
|
|
||
| @description('Enable support for private links') | ||
| param privateLinks bool = false | ||
|
|
||
| @description('If soft delete protection is enabled') | ||
| param keyVaultSoftDelete bool = true | ||
|
|
||
| @description('If purge protection is enabled') | ||
| param keyVaultPurgeProtection bool = true | ||
|
|
||
| @description('Add IP to KV firewall allow-list') | ||
| param keyVaultIPAllowlist array = [] | ||
|
|
||
| param logAnalyticsWorkspaceId string = '' | ||
|
|
||
| var akvRawName = 'kv-${replace(resourceName, '-', '')}${uniqueString(resourceGroup().id, resourceName)}' | ||
| var akvName = length(akvRawName) > 24 ? substring(akvRawName, 0, 24) : akvRawName | ||
|
|
||
| var kvIPRules = [for kvIp in keyVaultIPAllowlist: { | ||
| value: kvIp | ||
| }] | ||
|
|
||
| resource kv 'Microsoft.KeyVault/vaults@2021-11-01-preview' = { | ||
| name: akvName | ||
| location: location | ||
| properties: { | ||
| tenantId: subscription().tenantId | ||
| sku: { | ||
| family: 'A' | ||
| name: 'standard' | ||
| } | ||
| // publicNetworkAccess: whether the vault will accept traffic from public internet. If set to 'disabled' all traffic except private endpoint traffic and that that originates from trusted services will be blocked. | ||
| publicNetworkAccess: privateLinks && empty(keyVaultIPAllowlist) ? 'disabled' : 'enabled' | ||
|
|
||
| networkAcls: privateLinks && !empty(keyVaultIPAllowlist) ? { | ||
| bypass: 'AzureServices' | ||
| defaultAction: 'Deny' | ||
| ipRules: kvIPRules | ||
| virtualNetworkRules: [] | ||
| } : {} | ||
|
|
||
| enableRbacAuthorization: true | ||
| enabledForDeployment: false | ||
| enabledForDiskEncryption: false | ||
| enabledForTemplateDeployment: false | ||
| enableSoftDelete: keyVaultSoftDelete | ||
| enablePurgeProtection: keyVaultPurgeProtection ? true : json('null') | ||
| } | ||
| } | ||
|
|
||
| resource kvDiags 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = if (!empty(logAnalyticsWorkspaceId)) { | ||
| name: 'kvDiags' | ||
| scope: kv | ||
| properties: { | ||
| workspaceId: logAnalyticsWorkspaceId | ||
| logs: [ | ||
| { | ||
| category: 'AuditEvent' | ||
| enabled: true | ||
| } | ||
| ] | ||
| metrics: [ | ||
| { | ||
| category: 'AllMetrics' | ||
| enabled: true | ||
| } | ||
| ] | ||
| } | ||
| } | ||
|
|
||
| output keyVaultName string = kv.name | ||
| output keyVaultId string = kv.id |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| param keyVaultName string | ||
|
|
||
| @description('An array of Service Principal IDs') | ||
| param rbacSecretUserSps array = [] | ||
|
|
||
| @description('An array of Service Principal IDs') | ||
| param rbacSecretOfficerSps array = [] | ||
|
|
||
| @description('An array of Service Principal IDs') | ||
| param rbacCertOfficerSps array = [] | ||
|
|
||
| @description('An array of User IDs') | ||
| param rbacSecretOfficerUsers array = [] | ||
|
|
||
| @description('An array of User IDs') | ||
| param rbacCertOfficerUsers array = [] | ||
|
|
||
| var keyVaultSecretsUserRole = resourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6') | ||
| var keyVaultSecretsOfficerRole = resourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7') | ||
| var keyVaultCertsOfficerRole = resourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985') | ||
|
|
||
| resource kv 'Microsoft.KeyVault/vaults@2021-11-01-preview' existing = { | ||
| name: keyVaultName | ||
| } | ||
|
|
||
| resource rbacSecretUserSp 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = [for rbacSp in rbacSecretUserSps : if(!empty(rbacSp)) { | ||
| scope: kv | ||
| name: guid(kv.id, rbacSp, keyVaultSecretsUserRole) | ||
| properties: { | ||
| roleDefinitionId: keyVaultSecretsUserRole | ||
| principalType: 'ServicePrincipal' | ||
| principalId: rbacSp | ||
| } | ||
| }] | ||
|
|
||
| resource rbacSecretOfficerSp 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = [for rbacSp in rbacSecretOfficerSps : if(!empty(rbacSp)) { | ||
| scope: kv | ||
| name: guid(kv.id, rbacSp, keyVaultSecretsOfficerRole) | ||
| properties: { | ||
| roleDefinitionId: keyVaultSecretsOfficerRole | ||
| principalType: 'ServicePrincipal' | ||
| principalId: rbacSp | ||
| } | ||
| }] | ||
|
|
||
| resource rbacCertsOfficerSp 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = [for rbacSp in rbacCertOfficerSps : if(!empty(rbacSp)) { | ||
| scope: kv | ||
| name: guid(kv.id, rbacSp, keyVaultCertsOfficerRole) | ||
| properties: { | ||
| roleDefinitionId: keyVaultCertsOfficerRole | ||
| principalType: 'ServicePrincipal' | ||
| principalId: rbacSp | ||
| } | ||
| }] | ||
|
|
||
| resource rbacSecretOfficerUser 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = [for rbacSp in rbacSecretOfficerUsers : if(!empty(rbacSp)) { | ||
| scope: kv | ||
| name: guid(kv.id, rbacSp, keyVaultSecretsOfficerRole) | ||
| properties: { | ||
| roleDefinitionId: keyVaultSecretsOfficerRole | ||
| principalType: 'User' | ||
| principalId: rbacSp | ||
| } | ||
| }] | ||
|
|
||
| resource rbacCertsOfficerUser 'Microsoft.Authorization/roleAssignments@2021-04-01-preview' = [for rbacSp in rbacCertOfficerUsers : if(!empty(rbacSp)) { | ||
| scope: kv | ||
| name: guid(kv.id, rbacSp, keyVaultCertsOfficerRole) | ||
| properties: { | ||
| roleDefinitionId: keyVaultCertsOfficerRole | ||
| principalType: 'User' | ||
| principalId: rbacSp | ||
| } | ||
| }] |
Oops, something went wrong.