diff --git a/README.md b/README.md
index f5251de..721fca9 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@ Terraform module to create the Core component of each workload, currently only i
| Name | Source | Version |
|------|--------|---------|
-| [keyvault\_with\_cmk](#module\_keyvault\_with\_cmk) | github.com/schubergphilis/terraform-azure-mcaf-key-vault.git | n/a |
+| [keyvault\_with\_cmk](#module\_keyvault\_with\_cmk) | github.com/schubergphilis/terraform-azure-mcaf-key-vault.git | v0.3.1 |
## Resources
@@ -32,7 +32,7 @@ Terraform module to create the Core component of each workload, currently only i
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
-| [key\_vault](#input\_key\_vault) | n/a | object({
name = string
enabled_for_disk_encryption = optional(bool, false)
enabled_for_deployment = optional(bool, false)
enabled_for_template_deployment = optional(bool, false)
enable_rbac_authorization = optional(bool, true)
purge_protection = optional(bool, true)
soft_delete_retention_days = optional(number, 30)
sku = optional(string, "standard")
ip_rules = optional(list(string), [])
subnet_ids = optional(list(string), [])
network_bypass = optional(string, "None")
cmk_keys_create = optional(bool, true)
cmkrsa_key_name = optional(string, "cmkrsa")
cmkec_key_name = optional(string, "cmkec")
cmk_rotation_period = optional(string, "P90D")
}) | n/a | yes |
+| [key\_vault](#input\_key\_vault) | n/a | object({
name = string
enabled_for_disk_encryption = optional(bool, false)
enabled_for_deployment = optional(bool, false)
enabled_for_template_deployment = optional(bool, false)
enable_rbac_authorization = optional(bool, true)
purge_protection = optional(bool, true)
soft_delete_retention_days = optional(number, 30)
sku = optional(string, "standard")
ip_rules = optional(list(string), [])
subnet_ids = optional(list(string), [])
network_bypass = optional(string, "None")
cmk_keys_create = optional(bool, true)
cmkrsa_key_name = optional(string, "cmkrsa")
cmkec_key_name = optional(string, "cmkec")
cmk_rotation_period = optional(string, "P18M")
cmk_expiry_period = optional(string, "P2Y")
cmk_notify_period = optional(string, "P30D")
}) | n/a | yes |
| [location](#input\_location) | Location of the resources to create | `string` | n/a | yes |
| [resource\_group](#input\_resource\_group) | The name of the resource group in which to create the resources. | object({
name = string
}) | {
"name": null
} | no |
| [tags](#input\_tags) | A map of tags to assign to the resource. | `map(string)` | `{}` | no |
@@ -41,8 +41,11 @@ Terraform module to create the Core component of each workload, currently only i
| Name | Description |
|------|-------------|
-| [key\_vault\_cmkrsa\_id](#output\_key\_vault\_cmkrsa\_id) | CMK RSA Key ID |
-| [key\_vault\_cmkrsa\_key\_name](#output\_key\_vault\_cmkrsa\_key\_name) | CMK RSA Key Name |
+| [cmkrsa\_id](#output\_cmkrsa\_id) | CMK RSA Key ID |
+| [cmkrsa\_key\_name](#output\_cmkrsa\_key\_name) | CMK RSA Key Name |
+| [cmkrsa\_resource\_resource\_id](#output\_cmkrsa\_resource\_resource\_id) | CMK RSA Key Resource ID |
+| [cmkrsa\_resource\_versionless\_id](#output\_cmkrsa\_resource\_versionless\_id) | CMK RSA Key ID |
+| [cmkrsa\_verionsless\_id](#output\_cmkrsa\_verionsless\_id) | CMK RSA Key ID |
| [key\_vault\_id](#output\_key\_vault\_id) | n/a |
| [key\_vault\_name](#output\_key\_vault\_name) | n/a |
| [key\_vault\_uri](#output\_key\_vault\_uri) | n/a |
diff --git a/main.tf b/main.tf
index cbd0818..9cd25fd 100644
--- a/main.tf
+++ b/main.tf
@@ -12,7 +12,7 @@ resource "azurerm_resource_group" "this" {
}
module "keyvault_with_cmk" {
- source = "github.com/schubergphilis/terraform-azure-mcaf-key-vault.git?ref=v0.1.1"
+ source = "github.com/schubergphilis/terraform-azure-mcaf-key-vault.git?ref=v0.3.1"
key_vault = {
name = var.key_vault.name
@@ -25,11 +25,16 @@ module "keyvault_with_cmk" {
enable_rbac_authorization = true
purge_protection = true
soft_delete_retention_days = 30
+ public_network_access_enabled = false
+ default_action = "Deny"
sku = "standard"
ip_rules = length(var.key_vault.ip_rules) == 0 ? null : var.key_vault.ip_rules
subnet_ids = length(var.key_vault.subnet_ids) == 0 ? null : var.key_vault.subnet_ids
network_bypass = "AzureServices"
cmk_keys_create = true
+ cmk_rotation_period = var.key_vault.cmk_rotation_period
+ cmk_expiry_period = var.key_vault.cmk_expiry_period
+ cmk_notify_period = var.key_vault.cmk_notify_period
cmkrsa_key_name = var.key_vault.cmkrsa_key_name
cmkec_key_name = var.key_vault.cmkec_key_name
}
diff --git a/outputs.tf b/outputs.tf
index 8d43683..b2bd57f 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -10,12 +10,27 @@ output "key_vault_uri" {
value = module.keyvault_with_cmk.key_vault_uri
}
-output "key_vault_cmkrsa_key_name" {
- value = module.keyvault_with_cmk.key_vault_cmkrsa_key_name
+output "cmkrsa_key_name" {
+ value = module.keyvault_with_cmk.cmkrsa_key_name
description = "CMK RSA Key Name"
}
-output "key_vault_cmkrsa_id" {
- value = module.keyvault_with_cmk.key_vault_cmkrsa_id
+output "cmkrsa_id" {
+ value = module.keyvault_with_cmk.cmkrsa_id
description = "CMK RSA Key ID"
}
+
+output "cmkrsa_verionsless_id" {
+ value = module.keyvault_with_cmk.cmkrsa_versionless_id
+ description = "CMK RSA Key ID"
+}
+
+output "cmkrsa_resource_versionless_id" {
+ value = module.keyvault_with_cmk.cmkrsa_resource_versionless_id
+ description = "CMK RSA Key ID"
+}
+
+output "cmkrsa_resource_resource_id" {
+ value = module.keyvault_with_cmk.cmkrsa_resource_resource_id
+ description = "CMK RSA Key Resource ID"
+}
\ No newline at end of file
diff --git a/variables.tf b/variables.tf
index a033542..55a9a7f 100644
--- a/variables.tf
+++ b/variables.tf
@@ -24,7 +24,9 @@ variable "key_vault" {
cmk_keys_create = optional(bool, true)
cmkrsa_key_name = optional(string, "cmkrsa")
cmkec_key_name = optional(string, "cmkec")
- cmk_rotation_period = optional(string, "P90D")
+ cmk_rotation_period = optional(string, "P18M")
+ cmk_expiry_period = optional(string, "P2Y")
+ cmk_notify_period = optional(string, "P30D")
})
}