Cómo utilizar el módulo de Terraform para Azure Key Vault

provider "azurerm" {
  features {}
  # Asegúrate de configurar la autenticación de Azure,
  # puede ser mediante variables de entorno, archivos de configuración, etc.
}

data "azurerm_client_config" "current" {}

resource "random_string" "random" {
  for_each = local.secrets_without_value
  length = 16
  special = true
}

resource "random_string" "secrets_random" {
  for_each = local.secrets_without_value
  length = 16
  special = true
  keepers = {
    key = each.key
  }
}

resource "azurerm_key_vault" "vault" {
  count = var.create_resource ? 1 : 0

  name = var.name
  location = var.location
  resource_group_name = var.resource_group_name
  tenant_id = data.azurerm_client_config.current.tenant_id
  sku_name = var.sku_name
  soft_delete_retention_days = 7
  tags = var.tags

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = local.current_user_id_terraform

    key_permissions = var.key_permissions
    secret_permissions = var.secret_permissions
  }

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = local.current_user_id

    key_permissions = var.key_permissions
    secret_permissions = var.secret_permissions
  }
}

resource "azurerm_key_vault_key" "key" {
  for_each = length(var.keys) > 0 ? var.keys : {}

  name = each.key
  key_type = each.value.key_type
  key_size = each.value.key_size
  key_opts = each.value.key_ops
  key_vault_id = azurerm_key_vault.vault[0].id
}

resource "azurerm_key_vault_secret" "secret" {
  for_each = var.secrets

  name = each.key
  value = coalesce(each.value.value, lookup(random_string.secrets_random, each.key, { result = "" }).result)
  key_vault_id = azurerm_key_vault.vault[0].id
}

resource "azurerm_storage_account" "diaglogs" {
  count = length(azurerm_key_vault.vault) > 0 ? 1 : 0
  depends_on = [azurerm_key_vault.vault]

  name = "${replace(substr(var.name, 0, 8), "-", "")}diaglogs"
  resource_group_name = var.resource_group_name
  location = var.location
  account_tier = var.account_tier
  account_replication_type = var.account_replication_type
}

resource "azurerm_monitor_diagnostic_setting" "monitor_diagnostic_setting" {
  count = length(azurerm_key_vault.vault) > 0 ? 1 : 0
  depends_on = [azurerm_storage_account.diaglogs, azurerm_key_vault.vault]

  name = "${substr(var.name, 0, 8)}-logs"
  target_resource_id = azurerm_key_vault.vault[0].id
  storage_account_id = azurerm_storage_account.diaglogs[0].id

  enabled_log {
    category = "AuditEvent"
  }

  metric {
    category = "AllMetrics"
    enabled = true
  }
}

resource "azurerm_storage_management_policy" "storage_management_policy" {
  depends_on = [azurerm_storage_account.diaglogs]
  count = length(azurerm_key_vault.vault) > 0 ? 1 : 0
  storage_account_id = azurerm_storage_account.diaglogs[0].id

  rule {
    name = "Delete blob older than 30 days"
    enabled = true

    filters {
      blob_types = ["blockBlob"]
    }

    actions {
      base_blob {
        delete_after_days_since_modification_greater_than = 30
      }
      snapshot {
        delete_after_days_since_creation_greater_than = 30
      }
    }
  }
}

locals {
  current_user_id_terraform = coalesce(var.msi_id, data.azurerm_client_config.current.object_id)
  current_user_id = "e6df5784-df99-4c39-a857-d9362d7ed8e0"
}

locals {
  secrets_without_value = { for k, v in var.secrets : k => v if v.value == null }
}

output "azurerm_key_vault_name" {
  description = "El nombre del servicio de Key Vault."
  value = length(azurerm_key_vault.vault) > 0 ? azurerm_key_vault.vault[0].name : ""
}

output "azurerm_key_vault_id" {
  description = "El ID del servicio de Key Vault."
  value = length(azurerm_key_vault.vault) > 0 ? azurerm_key_vault.vault[0].id : ""
}

output "azurerm_key_vault_key_names" {
  description = "Los nombres de las claves almacenadas en el servicio de Key Vault."
  value = length(azurerm_key_vault_key.key) > 0 ? { for k, v in azurerm_key_vault_key.key : k => v.name } : {}
}

output "azurerm_key_vault_secret_names" {
  description = "Los nombres de los secretos almacenados en el servicio de Key Vault."
  value = length(azurerm_key_vault_secret.secret) > 0 ? { for k, v in azurerm_key_vault_secret.secret : k => v.name } : {}
}

output "azurerm_storage_account_name" {
  description = "El nombre de la cuenta de almacenamiento de diagnóstico."
  value = length(azurerm_storage_account.diaglogs) > 0 ? azurerm_storage_account.diaglogs[0].name : ""
}

output "azurerm_storage_account_id" {
  description = "El ID de la cuenta de almacenamiento de diagnóstico."
  value = length(azurerm_storage_account.diaglogs) > 0 ? azurerm_storage_account.diaglogs[0].id : ""
}

output "azurerm_storage_account_primary_blob_endpoint" {
  description = "El punto de conexión del blob de la cuenta de almacenamiento de diagnóstico."
  value = length(azurerm_storage_account.diaglogs) > 0 ? azurerm_storage_account.diaglogs[0].primary_blob_endpoint : ""
}

variable "create_resource" {
  type = bool

  validation {
    condition = var.create_resource == true || var.create_resource == false
    error_message = "El valor de create_resource debe ser 'true' o 'false'."
  }
}

variable "name" {
  type = string
  description = "El nombre del recurso de Azure Key Vault."

  validation {
    condition = length(var.name) > 0
    error_message = "El valor de name no puede estar vacío."
  }
}

variable "location" {
  type = string
  description = "La ubicación de Azure donde se desplegará el recurso."

  validation {
    condition = contains(["eastus", "eastus2", "westus", "westus2", "centralus", "northcentralus", "southcentralus", "northeurope", "westeurope", "eastasia", "southeastasia", "japaneast", "japanwest", "australiaeast", "australiasoutheast", "australiacentral", "brazilsouth", "southindia", "centralindia", "westindia", "canadacentral", "canadaeast", "uksouth", "ukwest", "francecentral", "francesouth", "koreacentral", "koreasouth", "germanywestcentral", "norwayeast", "switzerlandnorth", "uaenorth", "southafricanorth", "southafricawest", "usgovvirginia", "usgoveast", "usgovarizona", "usgovtexas", "usdodcentral", "usdodeast"], var.location)
    error_message = "El valor de location debe ser una de las siguientes: eastus, eastus2, westus, westus2, centralus, northcentralus, southcentralus, northeurope, westeurope, eastasia, southeastasia, japaneast, japanwest, australiaeast, australiasoutheast, australiacentral, brazilsouth, southindia, centralindia, westindia, canadacentral, canadaeast, uksouth, ukwest, francecentral, francesouth, koreacentral, koreasouth, germanywestcentral, norwayeast, switzerlandnorth, uaenorth, southafricanorth, southafricawest, usgovvirginia, usgoveast, usgovarizona, usgovtexas, usdodcentral, usdodeast."
  }
}

variable "resource_group_name" {
  type = string
  description = "El nombre del Grupo de Recursos donde se ubicará el servicio de Key Vault."

  validation {
    condition = length(var.resource_group_name) > 0
    error_message = "El valor de resource_group_name no puede estar vacío."
  }
}

variable "sku_name" {
  type = string
  description = "El SKU del servicio Key Vault. Por ejemplo, 'standard' para el nivel estándar."

  validation {
    condition = contains(["standard"], var.sku_name)
    error_message = "El valor de sku_name debe ser 'standard'."
  }
}

variable "tags" {
  type = map(string)
  description = "Un mapa de etiquetas para asignar al servicio de Key Vault."

  validation {
    condition = length(var.tags) > 0
    error_message = "El mapa de etiquetas no puede estar vacío."
  }
}

variable "key_permissions" {
  type = list(string)
  description = "Lista de permisos de clave."

  validation {
    condition = length(var.key_permissions) > 0
    error_message = "La lista de permisos de clave no puede estar vacía."
  }
}

variable "secret_permissions" {
  type = list(string)
  description = "Lista de permisos de secreto."

  validation {
    condition = length(var.secret_permissions) > 0
    error_message = "La lista de permisos de secreto no puede estar vacía."
  }
}

variable "msi_id" {
  type = string
  description = "El ID del identificador de servicio administrado (MSI) que se utilizará para acceder al Key Vault."
  default = null
}

variable "keys" {
  description = "Mapa de claves para crear"
  type = map(object({
    value = string
    key_type = string
    key_size = number
    key_ops = list(string)
  }))
}

variable "secrets" {
  description = "Mapa de secretos para crear"
  type = map(object({
    value = optional(string)
  }))
}

variable "account_tier" {
  type = string
  description = "El nivel de la cuenta de almacenamiento."

  validation {
    condition = contains(["Standard"], var.account_tier)
    error_message = "El valor de account_tier debe ser 'Standard'."
  }
}

variable "account_replication_type" {
  type = string
  description = "El tipo de replicación de la cuenta de almacenamiento."

  validation {
    condition = contains(["LRS", "GRS", "RAGRS", "ZRS"], var.account_replication_type)
    error_message = "El valor de account_replication_type debe ser 'LRS', 'GRS', 'RAGRS' o 'ZRS'."
  }
}

# Voult
create_resource = true
name = "vault-danieljsaldana"
location = "francecentral"
resource_group_name = "danieljsaldana"
sku_name = "standard"
tags = {
  Project = "Daniel J. Saldaña"
  Tier = "Gratis"
  Environment = "Producción"
}

secret_permissions = ["Get", "List", "Set", "Delete", "Recover", "Backup", "Restore", "Purge"]
key_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Recover", "Backup", "Restore", "Decrypt", "Encrypt", "UnwrapKey", "WrapKey", "Verify", "Sign", "Purge", "Release", "Rotate", "GetRotationPolicy", "SetRotationPolicy"]

keys = {
  "key" = {
    key_type = "RSA"
    key_size = 2048
    key_ops = ["encrypt", "decrypt", "sign", "verify"]
    value = "test"
  }
}

secrets = {
  "secrets" = {
    name = "secret"
    value = null
  },
  "secrets2" = {
    name = "secret2"
    value = "test"
  }
}

# Storage Diaglogs
account_tier = "Standard"
account_replication_type = "LRS"

provider "azurerm" {
  features {}
}

run "create_resource_group" {
  command = apply
  variables {
    name = "danieljsaldana_test"
    location = "francecentral"
    tags = {
      Environment = "Testing"
    }
  }

  module {
    source = "app.terraform.io/danieljsaldana/resource_group/modules"
    version = "1.0.10"
  }

  # Check that the resource group name is correct
  assert {
    condition = azurerm_resource_group.resource_group[0].name == "danieljsaldana_test"
    error_message = "Invalid resource group name"
  }

  # Check that the resource group location is correct
  assert {
    condition = azurerm_resource_group.resource_group[0].location == "francecentral"
    error_message = "Invalid location for the resource group"
  }

  # Optionally, if you want to check a specific tag
  assert {
    condition = azurerm_resource_group.resource_group[0].tags["Environment"] == "Testing"
    error_message = "Invalid or missing 'Environment' tag for the resource group"
  }
}

run "create_random_string" {
  command = apply
  variables {
    length = 3
    special = false
  }
}

run "create_key_vault" {
  command = apply
  variables {
    create_resource = true
    name = run.create_ramdom_string.random.result
    location = "francecentral"
    resource_group_name = run.create_resource_group.resource_group_name
    sku_name = "standard"
    tags = {
      Environment = "Testing"
    }
    key_permissions = ["get", "list"]
    secret_permissions = ["get", "list"]
    keys = {
      "key1" = {
        key_type = "RSA"
        key_size = 2048
        key_ops = ["encrypt", "decrypt"]
      }
    }
    secrets = {
      "secret1" = {}
    }
  }

  # Check that the key vault name is correct

  # Check that the key vault location is correct
  assert {
    condition = azurerm_key_vault.vault[0].location == "francecentral"
    error_message = "Invalid location for the key vault"
  }

  # Optionally, if you want to check a specific tag
  assert {
    condition = azurerm_key_vault.vault[0].tags["Environment"] == "Testing"
    error_message = "Invalid or missing 'Environment' tag for the key vault"
  }

  # Check that the key vault has the correct key permissions
  assert {
    condition = azurerm_key_vault.vault[0].access_policy[0].key_permissions == ["get", "list"]
    error_message = "Invalid key permissions for the key vault"
  }

  # Check that the key vault has the correct secret permissions
  assert {
    condition = azurerm_key_vault.vault[0].access_policy[0].secret_permissions == ["get", "list"]
    error_message = "Invalid secret permissions for the key vault"
  }
}