Azure Key Vault Secret

azurerm_key_vault_secret (Terraform)

The Secret in Key Vault can be configured in Terraform with the resource name azurerm_key_vault_secret. The following sections describe 3 examples of how to use the resource and its parameters.

Example Usage from GitHub

garrypas/scoparella.api

resource "azurerm_key_vault_secret" "database_password" {
  name         = "dbpassword"
  value        = random_password.database_password.result
  key_vault_id = azurerm_key_vault.keyvault.id

  tags = {

Azure/osdu-infrastructure

resource "azurerm_key_vault_secret" "base_name_cr" {
  name         = "base-name-cr"
  value        = local.base_name_60
  key_vault_id = module.keyvault.keyvault_id
}

Azure/osdu-infrastructure

resource "azurerm_key_vault_secret" "partition_id" {
  name         = local.partition_id
  value        = var.data_partition_name
  key_vault_id = data.terraform_remote_state.central_resources.outputs.keyvault_id
}

Security Best Practices for azurerm_key_vault_secret

There are 2 settings in azurerm_key_vault_secret that should be taken care of for security reasons. The following section explain an overview and example code.

Ensure to set a content type

It is better to set a content type to aid interpretation on retrieval.

Ensure to configure the expiration date for secrets

It is better to configure the expiration date for secrets which is not set by default.

Parameters

• content_type optional - string
• expiration_date optional - string
• id optional computed - string
• key_vault_id required - string
• name required - string
• not_before_date optional - string
• tags optional - map from string to string
• value required - string
• version optional computed - string
• versionless_id optional computed - string
• timeouts single block
  • create optional - string
  • delete optional - string
  • read optional - string
  • update optional - string

Explanation in Terraform Registry

Manages a Key Vault Secret.

Note: All arguments including the secret value will be stored in the raw state as plain-text. Read more about sensitive data in state.

Tips: Best Practices for The Other Azure Key Vault Resources

In addition to the azurerm_key_vault, Azure Key Vault has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_key_vault

Ensure to specify a network ACL for the key vault

It is better to specify network ACL for the key vault. The default should be set to deny and Azure Services should be still accepted.

azurerm_key_vault_key

Ensure to configure the expiration date on all keys

It is better to configure the expiration date on all keys which is not set by default.