terraform-azurerm-aks/examples/named_cluster/kms.tf at f13b78acbc6e0c7e5f7c66f4d6ae17c5afd7d133 · Azure/terraform-azurerm-aks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
resource "azurerm_key_vault_key" "kms" {
  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
  key_type        = "RSA"
  key_vault_id    = azurerm_key_vault.des_vault.id
  name            = "etcd-encryption"
  expiration_date = timeadd("${formatdate("YYYY-MM-DD", timestamp())}T00:00:00Z", "168h")
  key_size        = 2048

  depends_on = [
    azurerm_key_vault_access_policy.current_user
  ]

  lifecycle {
    ignore_changes = [expiration_date]
  }
}

resource "azurerm_key_vault_access_policy" "kms" {
  key_vault_id = azurerm_key_vault.des_vault.id
  object_id    = azurerm_user_assigned_identity.test.principal_id
  tenant_id    = azurerm_user_assigned_identity.test.tenant_id
  key_permissions = [
    "Decrypt",
    "Encrypt",
  ]
}

resource "azurerm_role_assignment" "kms" {
  principal_id         = azurerm_user_assigned_identity.test.principal_id
  scope                = azurerm_key_vault.des_vault.id
  role_definition_name = "Key Vault Contributor"
}