benefits/terraform/key_vault.tf at 472ddbf60bacd3af82074b4e8d071651939863b7 · cal-itp/benefits · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
locals {
  # https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault#certificate_permissions
  all_certificate_permissions = [
    "Get",
    "List",
    "Update",
    "Create",
    "Import",
    "Delete",
    "Recover",
    "Backup",
    "Restore",
    "ManageContacts",
    "ManageIssuers",
    "GetIssuers",
    "ListIssuers",
    "SetIssuers",
    "DeleteIssuers",
  ]

  all_key_permissions = [
    "Get",
    "List",
    "Update",
    "Create",
    "Import",
    "Delete",
    "Recover",
    "Backup",
    "Restore",
    "GetRotationPolicy",
    "SetRotationPolicy",
    "Rotate",
  ]

  all_secret_permissions = [
    "Get",
    "List",
    "Set",
    "Delete",
    "Recover",
    "Backup",
    "Restore",
  ]

  key_vault_name              = "KV-CDT-PUB-CALITP-${local.env_letter}-001"
  key_vault_secret_uri_prefix = "https://${local.key_vault_name}.vault.azure.net/secrets"
}

resource "azurerm_key_vault" "main" {
  name                       = local.key_vault_name
  location                   = data.azurerm_resource_group.main.location
  resource_group_name        = data.azurerm_resource_group.main.name
  sku_name                   = "standard"
  tenant_id                  = data.azurerm_client_config.current.tenant_id
  purge_protection_enabled   = true
  rbac_authorization_enabled = false

  lifecycle {
    prevent_destroy = true
    ignore_changes = [
      tags,
      access_policy # IMPORTANT: Tell Terraform to ignore changes to access policies here since we aren't using inline policies
    ]
  }
}

# Standalone Access Policy for Engineering Group
resource "azurerm_key_vault_access_policy" "engineering" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = var.ENGINEERING_GROUP_OBJECT_ID

  certificate_permissions = local.all_certificate_permissions
  key_permissions         = local.all_key_permissions
  secret_permissions      = local.all_secret_permissions

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}

# this access policy below can be removed when the ADO pipeline has been deprecated

# Standalone Access Policy for DevSecOps
resource "azurerm_key_vault_access_policy" "devsecops" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = var.DEVSECOPS_OBJECT_ID

  key_permissions    = local.all_key_permissions
  secret_permissions = local.all_secret_permissions

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}

# Standalone Access Policies for GH Actions Service Principals

resource "azurerm_key_vault_access_policy" "devsecops_apply" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = var.sp_apply_object_id

  secret_permissions = local.all_secret_permissions

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}

resource "azurerm_key_vault_access_policy" "devsecops_plan" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = var.sp_plan_object_id

  secret_permissions = ["Get", "List"]

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}

# https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli#granting-your-app-access-to-key-vault
# Standalone Access Policy for App Service Managed Identity
resource "azurerm_key_vault_access_policy" "webapp" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_linux_web_app.main.identity.0.principal_id

  secret_permissions = ["Get"]

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}

# Standalone Access Policy for the Benefits (web) Container App's Managed Identity
resource "azurerm_key_vault_access_policy" "web_container_app" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = module.application.web_principal_id

  secret_permissions = ["Get"]

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}

# Standalone Access Policy for the pgAdmin Container App's Managed Identity
resource "azurerm_key_vault_access_policy" "pgadmin_container_app" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = module.application.pgadmin_principal_id

  secret_permissions = ["Get"]

  # This ensures the Key Vault itself is created before trying to attach a policy.
  depends_on = [azurerm_key_vault.main]
}