Create an Azure Key Vault with RBAC role assignments using Terraform

Azure Key Vault is a Microsoft Azure resource that securely stores and manages sensitive data, including secrets, encryption keys, and certificates, it features soft deletion of secrets, renovation of certificates, and security features including Role-Based Access Control (RBAC) and private network access.

In this post, I will show you how to use Terraform to create an Azure Key Vault and populate it adding some secrets. Additionally, I will show you how to use Terraform to assign a user a role so that they can create secrets in Azure Key Vault.

Create an Azure Key Vault using Terraform

What do you need

  1. Your subscription_id, this is a GUID and you can get it using one of the following ways:

    • Using Azure CLI:

      az account subscription list

    • Using the Azure Portal.

  2. Your tenant_id, this is a GUID and you can get it using one of the following ways:

    • Using Azure CLI:

      az account tenant list

    • Using the Azure Portal in the column Directory ID.

      Azure Portal directories

Terraform files

main.tf

terraform {
  required_providers {
    azurerm: {
      source : "hashicorp/azurerm"
      version: "4.11.0"
    }
  }
}

provider "azurerm" {
  # Configuration options
  features {
    key_vault {
      purge_soft_delete_on_destroy   : true
      recover_soft_deleted_key_vaults: true
    }
  }

  subscription_id: "a838fdd3-56b8-4508-93db-9611367b3aee" # Put your 'subscription_id' here

  tenant_id: "c4421ca3-5bd8-472b-99c4-6b231540eac1" # Put your 'tenant_id' here
}

data "azurerm_client_config" "current" {}

In this file you declare the Terraform provider.

keyvault.tf

resource "azurerm_resource_group" "secrets_rg" {
  name    : "secrets"
  location: "westus3"
}

resource "azurerm_key_vault" "secrets_keyvault" {
  tenant_id          : data.azurerm_client_config.current.tenant_id
  resource_group_name: azurerm_resource_group.secrets_rg.name

  name    : "secrets"
  location: azurerm_resource_group.secrets_rg.location

  enable_rbac_authorization      : true
  enabled_for_deployment         : false
  enabled_for_disk_encryption    : false
  enabled_for_template_deployment: true
  public_network_access_enabled  : false
  purge_protection_enabled       : true
  soft_delete_retention_days     : 90

  sku_name: "standard"
}

You can customize the Azure Key Vault in this file.

secrets.tf

resource "azurerm_key_vault_secret" "db_development" {
  name        : "DbConnectionStringDevelopment"
  value       : "mysql://root:password123@db.example.com:3306/mydatabase"
  key_vault_id: azurerm_key_vault.secrets_keyvault.id
}

This file will store non-sensitive secrets, such as secrets for development or integration environments.

Role assignment using Terraform

Now we are assigning a user a role to access and manage secrets in the Azure Key Vault previously created.

Azure RBAC has some built-in roles that can be assigned to a user or group, allowing granular control over access to Azure Key Vault.

What do you need

  1. The principal_id of the user or group (also known as Object ID), this is a GUID and you can get it using one of the following ways:

    • Using Azure CLI:

      az ad user list --query "[].{Id:id, Name: displayName, Email: mail}" --output table

    • Using the Azure Portal.

  2. The role_definition_id of the role that you want to assign, this is a GUID and you can get it using one of the following ways:

    • Using Azure CLI:

      az role definition list --query "[?contains(roleName, 'Key Vault')].{Name:name, Description: description}" --output table

    • Using the Microsoft Docs in the column ID.

Terraform files

rbac.tf

resource "azurerm_role_assignment" "keyvault_secrets_officer_john" {
  scope: azurerm_key_vault.secrets_keyvault.id

  principal_id      : "8c4ab003-5dcd-49e2-86df-8f96b1f46a0d" # Put your 'principal_id' here
  role_definition_id: "b86a8fe4-44ce-4948-aee5-eccb2c155cd7" # Put your 'role_definition_id' here
}

References