Update Key Vault to Support RBAC Permissions and Delete Protection

[AErmie]

⚠️ Problem

For organizations that utilize the Enterprise Scale in association with the Cloud Adoption Framework (CAF), there are various Azure Policies and Initiatives that are deployed.

One of those Initiatives is the Enforce recommended guardrails for Azure Key Vault. This initiative contains several policies, including:

• Azure Key Vault should use RBAC permission model
• Key vaults should have deletion protection enabled

The current deployment of the FinOps Toolkit (Hub architecture), violates those 2 policies and prevents its deployment. We have to add/create an exception in the target Subscription / Resource Group, for the deployment to complete successfully.

🛠️ Solution

Update the FinOps Toolkit's Key Vault implementation to support the RBAC permissions model, and also enable delete protection.

ℹ️ Additional context

The client I am currently assisting, is in a regulated industry, and uses the CAF / Enterprise Scale Terraform modules.

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Leave comments to help us solidify the vision.

[flanakin]

Makes sense. I'm not familiar with these options, but we can probably look at this in December. If you're familiar with bicep and would like to see this sooner, we'd welcome a PR to add this. Or if you know the settings that need to be applied, you could share them here, which might speed things up. Just let us know.

Either way, thanks for the feedback!

[flanakin]

@allcontributors please add AErmie for feature

[allcontributors]

@flanakin

I couldn't determine any contributions to add, did you specify any contributions?
Please make sure to use valid contribution names.

[AErmie]

@flanakin, I believe the REST API properties are:

• enableRbacAuthorization
• enableSoftDelete
• enablePurgeProtection

See: https://learn.microsoft.com/en-us/rest/api/keyvault/keyvault/vaults/create-or-update?view=rest-keyvault-keyvault-2022-07-01&tabs=HTTP#vaultproperties