Azure Key Vault Secret
This page shows how to write Terraform for Key Vault Secret and write them securely.
azurerm_key_vault_secret (Terraform)
The Secret in Key Vault can be configured in Terraform with the resource name azurerm_key_vault_secret
. The following sections describe 3 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_key_vault_secret" "database_password" {
name = "dbpassword"
value = random_password.database_password.result
key_vault_id = azurerm_key_vault.keyvault.id
tags = {
resource "azurerm_key_vault_secret" "base_name_cr" {
name = "base-name-cr"
value = local.base_name_60
key_vault_id = module.keyvault.keyvault_id
}
resource "azurerm_key_vault_secret" "partition_id" {
name = local.partition_id
value = var.data_partition_name
key_vault_id = data.terraform_remote_state.central_resources.outputs.keyvault_id
}
Security Best Practices for azurerm_key_vault_secret
There are 2 settings in azurerm_key_vault_secret that should be taken care of for security reasons. The following section explain an overview and example code.
Ensure to set a content type
It is better to set a content type to aid interpretation on retrieval.
Ensure to configure the expiration date for secrets
It is better to configure the expiration date for secrets which is not set by default.
Parameters
-
content_type
optional - string -
expiration_date
optional - string -
id
optional computed - string -
key_vault_id
required - string -
name
required - string -
not_before_date
optional - string -
tags
optional - map from string to string -
value
required - string -
version
optional computed - string -
versionless_id
optional computed - string -
timeouts
single block
Explanation in Terraform Registry
Manages a Key Vault Secret.
Note: All arguments including the secret value will be stored in the raw state as plain-text. Read more about sensitive data in state.
Tips: Best Practices for The Other Azure Key Vault Resources
In addition to the azurerm_key_vault, Azure Key Vault has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_key_vault
Ensure to specify a network ACL for the key vault
It is better to specify network ACL for the key vault. The default should be set to deny and Azure Services should be still accepted.
azurerm_key_vault_key
Ensure to configure the expiration date on all keys
It is better to configure the expiration date on all keys which is not set by default.
Azure Resource Manager Example
Azure Resource Manager code does not have the related resource.
Frequently asked questions
What is Azure Key Vault Secret?
Azure Key Vault Secret is a resource for Key Vault of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Key Vault Secret?
For Terraform, the garrypas/scoparella.api, Azure/osdu-infrastructure and Azure/osdu-infrastructure source code examples are useful. See the Terraform Example section for further details.