Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added Dynamic Access Policy #77

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Added Dynamic Access Policy #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f6b9570
Feat: Added Key-Vault Secret Resource
vedant990 Feb 10, 2025
636dadb
Feat : Added Dynamic Access Policy
vedant990 Feb 17, 2025
fe3e620
Merge branch 'master' into feat/update
vedant990 Feb 17, 2025
fd67d97
Feat : Added Key Vault Contributor Role Assignment
vedant990 Feb 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,18 @@ resource "azurerm_key_vault" "key_vault" {
phone = contact.value.phone
}
}
dynamic "access_policy" {
for_each = var.use_dynamic_access_policy ? var.access_policies : []
content {
tenant_id = data.azurerm_client_config.current_client_config.tenant_id
object_id = access_policy.value.object_id
certificate_permissions = access_policy.value.certificate_permissions
key_permissions = access_policy.value.key_permissions
secret_permissions = access_policy.value.secret_permissions
storage_permissions = access_policy.value.storage_permissions
}
}


lifecycle {
ignore_changes = [
Expand All @@ -90,7 +102,7 @@ resource "azurerm_key_vault_secret" "key_vault_secret" {
##-----------------------------------------------------------------------------
resource "azurerm_key_vault_access_policy" "readers_policy" {
provider = azurerm.main_sub
for_each = toset(var.enable_rbac_authorization && var.enabled && !var.managed_hardware_security_module_enabled ? [] : var.reader_objects_ids)
for_each = toset(var.use_dynamic_access_policy || var.enable_rbac_authorization && var.enabled && !var.managed_hardware_security_module_enabled ? [] : var.reader_objects_ids)

object_id = each.value
tenant_id = data.azurerm_client_config.current_client_config.tenant_id
Expand All @@ -114,7 +126,7 @@ resource "azurerm_key_vault_access_policy" "readers_policy" {

resource "azurerm_key_vault_access_policy" "admin_policy" {
provider = azurerm.main_sub
for_each = toset(var.enable_rbac_authorization && var.enabled && !var.managed_hardware_security_module_enabled ? [] : var.admin_objects_ids)
for_each = toset(var.use_dynamic_access_policy || var.enable_rbac_authorization && var.enabled && !var.managed_hardware_security_module_enabled ? [] : var.reader_objects_ids)

object_id = each.value
tenant_id = data.azurerm_client_config.current_client_config.tenant_id
Expand Down Expand Up @@ -180,7 +192,7 @@ resource "azurerm_key_vault_access_policy" "admin_policy" {
##-----------------------------------------------------------------------------
resource "azurerm_role_assignment" "rbac_keyvault_administrator" {
provider = azurerm.main_sub
for_each = toset(var.enable_rbac_authorization && var.enabled && !var.managed_hardware_security_module_enabled ? var.admin_objects_ids : [])
for_each = toset(var.enable_rbac_authorization && var.enabled && var.keyvault_admin_enabled && !var.managed_hardware_security_module_enabled ? var.admin_objects_ids : [])

scope = azurerm_key_vault.key_vault[0].id
role_definition_name = "Key Vault Administrator"
Expand All @@ -205,6 +217,15 @@ resource "azurerm_role_assignment" "rbac_keyvault_reader" {
principal_id = each.value
}

resource "azurerm_role_assignment" "rbac_keyvault_contributor" {
provider = azurerm.main_sub
for_each = toset(var.enable_rbac_authorization && var.enabled && !var.managed_hardware_security_module_enabled ? var.contributor_objects_ids : [])

scope = azurerm_key_vault.key_vault[0].id
role_definition_name = "Key Vault Contributor"
principal_id = each.value
}

##-----------------------------------------------------------------------------
##Below resource will deploy private endpoint for key vault.
##-----------------------------------------------------------------------------
Expand Down
29 changes: 29 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,11 @@ variable "secrets" {
default = {}
}

variable "use_dynamic_access_policy" {
description = "If true, use dynamic access policy block within azurerm_key_vault. If false, use separate azurerm_key_vault_access_policy resource."
type = bool
default = false
}

variable "managedby" {
type = string
Expand Down Expand Up @@ -265,3 +270,27 @@ variable "network_acls" {
})
default = {}
}

variable "access_policies" {
type = list(object({
object_id = string,
certificate_permissions = list(string),
key_permissions = list(string),
secret_permissions = list(string),
storage_permissions = list(string),
}))
default = []
description = "Map of access policies for an object_id (user, service principal, security group) to backend."
}

variable "keyvault_admin_enabled" {
type = bool
default = false
description = "Controls whether to assign Key Vault Administrator (true) or Key Vault Contributor (false) roles to the specified principals."
}

variable "contributor_objects_ids" {
type = list(string)
default = []
description = "List of principal IDs (Object IDs) that will be assigned the Key Vault Contributor role when keyvault_admin_enabled is set to false. These can be User, Group, or Service Principal Object IDs from Azure Active Directory."
}