Skip to content

Commit 822542f

Browse files
AlexanderSehrGosselin-leriqua
authored
feat: Added KeyVault key & secret outputs (#3603)
## Description - Added KeyVault key & secrets outputs (Note: An output map was technically not possibe) - Moved UDTs to common-types module where possible - Based on #3246 - Depends on #3606 - Depends on microsoft/PSRule#2591 & Release https://github.com/Azure/PSRule.Rules.Azure/milestone/127 ## Pipeline Reference <!-- Insert your Pipeline Status Badge below --> | Pipeline | | -------- | | [![avm.res.key-vault.vault](https://github.com/AlexanderSehr/bicep-registry-modules/actions/workflows/avm.res.key-vault.vault.yml/badge.svg?branch=users%2Falsehr%2FGosselin-l_keyvault_key_moreOutputs&event=workflow_dispatch)](https://github.com/AlexanderSehr/bicep-registry-modules/actions/workflows/avm.res.key-vault.vault.yml) | ## Type of Change <!-- Use the checkboxes [x] on the options that are relevant. --> - [ ] Update to CI Environment or utilities (Non-module affecting changes) - [x] Azure Verified Module updates: - [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in `version.json`: - [ ] Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description. - [ ] The bug was found by the module author, and no one has opened an issue to report it yet. - [ ] Feature update backwards compatible feature updates, and I have bumped the MINOR version in `version.json`. - [ ] Breaking changes and I have bumped the MAJOR version in `version.json`. - [ ] Update to documentation --------- Co-authored-by: Laurent <[email protected]> Co-authored-by: Erika Gressi <[email protected]>
1 parent 82e0820 commit 822542f

File tree

13 files changed

+1735
-1574
lines changed

13 files changed

+1735
-1574
lines changed

‎avm/res/key-vault/vault/README.md

+29-40
Original file line numberDiff line numberDiff line change
@@ -1294,10 +1294,6 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
12941294
}
12951295
]
12961296
location: '<location>'
1297-
lock: {
1298-
kind: 'CanNotDelete'
1299-
name: 'myCustomLockName'
1300-
}
13011297
networkAcls: {
13021298
bypass: 'AzureServices'
13031299
defaultAction: 'Deny'
@@ -1407,12 +1403,6 @@ module vault 'br/public:avm/res/key-vault/vault:<version>' = {
14071403
"location": {
14081404
"value": "<location>"
14091405
},
1410-
"lock": {
1411-
"value": {
1412-
"kind": "CanNotDelete",
1413-
"name": "myCustomLockName"
1414-
}
1415-
},
14161406
"networkAcls": {
14171407
"value": {
14181408
"bypass": "AzureServices",
@@ -1520,10 +1510,6 @@ param keys = [
15201510
}
15211511
]
15221512
param location = '<location>'
1523-
param lock = {
1524-
kind: 'CanNotDelete'
1525-
name: 'myCustomLockName'
1526-
}
15271513
param networkAcls = {
15281514
bypass: 'AzureServices'
15291515
defaultAction: 'Deny'
@@ -1798,7 +1784,7 @@ The diagnostic settings of the service.
17981784
| [`logCategoriesAndGroups`](#parameter-diagnosticsettingslogcategoriesandgroups) | array | The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to `[]` to disable log collection. |
17991785
| [`marketplacePartnerResourceId`](#parameter-diagnosticsettingsmarketplacepartnerresourceid) | string | The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs. |
18001786
| [`metricCategories`](#parameter-diagnosticsettingsmetriccategories) | array | The name of metrics that will be streamed. "allMetrics" includes all possible metrics for the resource. Set to `[]` to disable metric collection. |
1801-
| [`name`](#parameter-diagnosticsettingsname) | string | The name of diagnostic setting. |
1787+
| [`name`](#parameter-diagnosticsettingsname) | string | The name of the diagnostic setting. |
18021788
| [`storageAccountResourceId`](#parameter-diagnosticsettingsstorageaccountresourceid) | string | Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
18031789
| [`workspaceResourceId`](#parameter-diagnosticsettingsworkspaceresourceid) | string | Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
18041790

@@ -1908,7 +1894,7 @@ Enable or disable the category explicitly. Default is `true`.
19081894

19091895
### Parameter: `diagnosticSettings.name`
19101896

1911-
The name of diagnostic setting.
1897+
The name of the diagnostic setting.
19121898

19131899
- Required: No
19141900
- Type: string
@@ -2435,22 +2421,22 @@ Configuration details for private endpoints. For security reasons, it is recomme
24352421

24362422
| Parameter | Type | Description |
24372423
| :-- | :-- | :-- |
2438-
| [`applicationSecurityGroupResourceIds`](#parameter-privateendpointsapplicationsecuritygroupresourceids) | array | Application security groups in which the private endpoint IP configuration is included. |
2424+
| [`applicationSecurityGroupResourceIds`](#parameter-privateendpointsapplicationsecuritygroupresourceids) | array | Application security groups in which the Private Endpoint IP configuration is included. |
24392425
| [`customDnsConfigs`](#parameter-privateendpointscustomdnsconfigs) | array | Custom DNS configurations. |
2440-
| [`customNetworkInterfaceName`](#parameter-privateendpointscustomnetworkinterfacename) | string | The custom name of the network interface attached to the private endpoint. |
2426+
| [`customNetworkInterfaceName`](#parameter-privateendpointscustomnetworkinterfacename) | string | The custom name of the network interface attached to the Private Endpoint. |
24412427
| [`enableTelemetry`](#parameter-privateendpointsenabletelemetry) | bool | Enable/Disable usage telemetry for module. |
2442-
| [`ipConfigurations`](#parameter-privateendpointsipconfigurations) | array | A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints. |
2428+
| [`ipConfigurations`](#parameter-privateendpointsipconfigurations) | array | A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints. |
24432429
| [`isManualConnection`](#parameter-privateendpointsismanualconnection) | bool | If Manual Private Link Connection is required. |
2444-
| [`location`](#parameter-privateendpointslocation) | string | The location to deploy the private endpoint to. |
2430+
| [`location`](#parameter-privateendpointslocation) | string | The location to deploy the Private Endpoint to. |
24452431
| [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
24462432
| [`manualConnectionRequestMessage`](#parameter-privateendpointsmanualconnectionrequestmessage) | string | A message passed to the owner of the remote resource with the manual connection request. |
2447-
| [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
2448-
| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS zone group to configure for the private endpoint. |
2433+
| [`name`](#parameter-privateendpointsname) | string | The name of the Private Endpoint. |
2434+
| [`privateDnsZoneGroup`](#parameter-privateendpointsprivatednszonegroup) | object | The private DNS Zone Group to configure for the Private Endpoint. |
24492435
| [`privateLinkServiceConnectionName`](#parameter-privateendpointsprivatelinkserviceconnectionname) | string | The name of the private link connection to create. |
2450-
| [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different resource group than the main resource. |
2436+
| [`resourceGroupName`](#parameter-privateendpointsresourcegroupname) | string | Specify if you want to deploy the Private Endpoint into a different Resource Group than the main resource. |
24512437
| [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
2452-
| [`service`](#parameter-privateendpointsservice) | string | The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory". |
2453-
| [`tags`](#parameter-privateendpointstags) | object | Tags to be applied on all resources/resource groups in this deployment. |
2438+
| [`service`](#parameter-privateendpointsservice) | string | The subresource to deploy the Private Endpoint for. For example "vault" for a Key Vault Private Endpoint. |
2439+
| [`tags`](#parameter-privateendpointstags) | object | Tags to be applied on all resources/Resource Groups in this deployment. |
24542440

24552441
### Parameter: `privateEndpoints.subnetResourceId`
24562442

@@ -2461,7 +2447,7 @@ Resource ID of the subnet where the endpoint needs to be created.
24612447

24622448
### Parameter: `privateEndpoints.applicationSecurityGroupResourceIds`
24632449

2464-
Application security groups in which the private endpoint IP configuration is included.
2450+
Application security groups in which the Private Endpoint IP configuration is included.
24652451

24662452
- Required: No
24672453
- Type: array
@@ -2501,7 +2487,7 @@ FQDN that resolves to private endpoint IP address.
25012487

25022488
### Parameter: `privateEndpoints.customNetworkInterfaceName`
25032489

2504-
The custom name of the network interface attached to the private endpoint.
2490+
The custom name of the network interface attached to the Private Endpoint.
25052491

25062492
- Required: No
25072493
- Type: string
@@ -2515,7 +2501,7 @@ Enable/Disable usage telemetry for module.
25152501

25162502
### Parameter: `privateEndpoints.ipConfigurations`
25172503

2518-
A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints.
2504+
A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints.
25192505

25202506
- Required: No
25212507
- Type: array
@@ -2579,7 +2565,7 @@ If Manual Private Link Connection is required.
25792565

25802566
### Parameter: `privateEndpoints.location`
25812567

2582-
The location to deploy the private endpoint to.
2568+
The location to deploy the Private Endpoint to.
25832569

25842570
- Required: No
25852571
- Type: string
@@ -2629,14 +2615,14 @@ A message passed to the owner of the remote resource with the manual connection
26292615

26302616
### Parameter: `privateEndpoints.name`
26312617

2632-
The name of the private endpoint.
2618+
The name of the Private Endpoint.
26332619

26342620
- Required: No
26352621
- Type: string
26362622

26372623
### Parameter: `privateEndpoints.privateDnsZoneGroup`
26382624

2639-
The private DNS zone group to configure for the private endpoint.
2625+
The private DNS Zone Group to configure for the Private Endpoint.
26402626

26412627
- Required: No
26422628
- Type: object
@@ -2645,7 +2631,7 @@ The private DNS zone group to configure for the private endpoint.
26452631

26462632
| Parameter | Type | Description |
26472633
| :-- | :-- | :-- |
2648-
| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones. |
2634+
| [`privateDnsZoneGroupConfigs`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigs) | array | The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones. |
26492635

26502636
**Optional parameters**
26512637

@@ -2655,7 +2641,7 @@ The private DNS zone group to configure for the private endpoint.
26552641

26562642
### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs`
26572643

2658-
The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.
2644+
The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones.
26592645

26602646
- Required: Yes
26612647
- Type: array
@@ -2670,7 +2656,7 @@ The private DNS zone groups to associate the private endpoint. A DNS zone group
26702656

26712657
| Parameter | Type | Description |
26722658
| :-- | :-- | :-- |
2673-
| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS zone group config. |
2659+
| [`name`](#parameter-privateendpointsprivatednszonegroupprivatednszonegroupconfigsname) | string | The name of the private DNS Zone Group config. |
26742660

26752661
### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.privateDnsZoneResourceId`
26762662

@@ -2681,7 +2667,7 @@ The resource id of the private DNS zone.
26812667

26822668
### Parameter: `privateEndpoints.privateDnsZoneGroup.privateDnsZoneGroupConfigs.name`
26832669

2684-
The name of the private DNS zone group config.
2670+
The name of the private DNS Zone Group config.
26852671

26862672
- Required: No
26872673
- Type: string
@@ -2702,7 +2688,7 @@ The name of the private link connection to create.
27022688

27032689
### Parameter: `privateEndpoints.resourceGroupName`
27042690

2705-
Specify if you want to deploy the Private Endpoint into a different resource group than the main resource.
2691+
Specify if you want to deploy the Private Endpoint into a different Resource Group than the main resource.
27062692

27072693
- Required: No
27082694
- Type: string
@@ -2723,7 +2709,7 @@ Array of role assignments to create.
27232709
- `'Owner'`
27242710
- `'Private DNS Zone Contributor'`
27252711
- `'Reader'`
2726-
- `'Role Based Access Control Administrator (Preview)'`
2712+
- `'Role Based Access Control Administrator'`
27272713

27282714
**Required parameters**
27292715

@@ -2817,14 +2803,14 @@ The principal type of the assigned principal ID.
28172803

28182804
### Parameter: `privateEndpoints.service`
28192805

2820-
The subresource to deploy the private endpoint for. For example "vault", "mysqlServer" or "dataFactory".
2806+
The subresource to deploy the Private Endpoint for. For example "vault" for a Key Vault Private Endpoint.
28212807

28222808
- Required: No
28232809
- Type: string
28242810

28252811
### Parameter: `privateEndpoints.tags`
28262812

2827-
Tags to be applied on all resources/resource groups in this deployment.
2813+
Tags to be applied on all resources/Resource Groups in this deployment.
28282814

28292815
- Required: No
28302816
- Type: object
@@ -3187,11 +3173,13 @@ Resource tags.
31873173

31883174
| Output | Type | Description |
31893175
| :-- | :-- | :-- |
3176+
| `keys` | array | The properties of the created keys. |
31903177
| `location` | string | The location the resource was deployed into. |
31913178
| `name` | string | The name of the key vault. |
31923179
| `privateEndpoints` | array | The private endpoints of the key vault. |
31933180
| `resourceGroupName` | string | The name of the resource group the key vault was created in. |
31943181
| `resourceId` | string | The resource ID of the key vault. |
3182+
| `secrets` | array | The properties of the created secrets. |
31953183
| `uri` | string | The URI of the key vault. |
31963184

31973185
## Cross-referenced modules
@@ -3200,7 +3188,8 @@ This section gives you an overview of all local-referenced module files (i.e., o
32003188

32013189
| Reference | Type |
32023190
| :-- | :-- |
3203-
| `br/public:avm/res/network/private-endpoint:0.7.1` | Remote reference |
3191+
| `br/public:avm/res/network/private-endpoint:0.9.0` | Remote reference |
3192+
| `br/public:avm/utl/types/avm-common-types:0.2.1` | Remote reference |
32043193

32053194
## Data Collection
32063195

‎avm/res/key-vault/vault/access-policy/main.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@
55
"metadata": {
66
"_generator": {
77
"name": "bicep",
8-
"version": "0.30.23.60470",
9-
"templateHash": "15469258025112973480"
8+
"version": "0.31.92.45157",
9+
"templateHash": "2943121976508120416"
1010
},
1111
"name": "Key Vault Access Policies",
1212
"description": "This module deploys a Key Vault Access Policy.",

‎avm/res/key-vault/vault/key/README.md

+11
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ This module deploys a Key Vault Key.
77
- [Resource Types](#Resource-Types)
88
- [Parameters](#Parameters)
99
- [Outputs](#Outputs)
10+
- [Cross-referenced modules](#Cross-referenced-modules)
1011

1112
## Resource Types
1213

@@ -275,6 +276,16 @@ Resource tags.
275276

276277
| Output | Type | Description |
277278
| :-- | :-- | :-- |
279+
| `keyUri` | string | The uri of the key. |
280+
| `keyUriWithVersion` | string | The uri with version of the key. |
278281
| `name` | string | The name of the key. |
279282
| `resourceGroupName` | string | The name of the resource group the key was created in. |
280283
| `resourceId` | string | The resource ID of the key. |
284+
285+
## Cross-referenced modules
286+
287+
This section gives you an overview of all local-referenced module files (i.e., other modules that are referenced in this module) and all remote-referenced files (i.e., Bicep modules that are referenced from a Bicep Registry or Template Specs).
288+
289+
| Reference | Type |
290+
| :-- | :-- |
291+
| `br/public:avm/utl/types/avm-common-types:0.2.1` | Remote reference |

‎avm/res/key-vault/vault/key/main.bicep

+13-34
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,9 @@ param kty string = 'EC'
5656
@description('Optional. Key release policy.')
5757
param releasePolicy object?
5858

59+
import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.2.1'
5960
@description('Optional. Array of role assignments to create.')
60-
param roleAssignments roleAssignmentType
61+
param roleAssignments roleAssignmentType[]?
6162

6263
@description('Optional. Key rotation policy properties object.')
6364
param rotationPolicy object?
@@ -130,9 +131,11 @@ resource key 'Microsoft.KeyVault/vaults/keys@2022-07-01' = {
130131
keySize: keySize
131132
kty: kty
132133
release_policy: releasePolicy ?? {}
133-
...(empty(rotationPolicy) ? {} : {
134-
rotationPolicy: rotationPolicy
135-
})
134+
...(!empty(rotationPolicy)
135+
? {
136+
rotationPolicy: rotationPolicy
137+
}
138+
: {})
136139
}
137140
}
138141

@@ -152,6 +155,12 @@ resource key_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01
152155
}
153156
]
154157

158+
@description('The uri of the key.')
159+
output keyUri string = key.properties.keyUri
160+
161+
@description('The uri with version of the key.')
162+
output keyUriWithVersion string = key.properties.keyUriWithVersion
163+
155164
@description('The name of the key.')
156165
output name string = key.name
157166

@@ -160,33 +169,3 @@ output resourceId string = key.id
160169

161170
@description('The name of the resource group the key was created in.')
162171
output resourceGroupName string = resourceGroup().name
163-
164-
// ================ //
165-
// Definitions //
166-
// ================ //
167-
168-
type roleAssignmentType = {
169-
@description('Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated.')
170-
name: string?
171-
172-
@description('Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
173-
roleDefinitionIdOrName: string
174-
175-
@description('Required. The principal ID of the principal (user/group/identity) to assign the role to.')
176-
principalId: string
177-
178-
@description('Optional. The principal type of the assigned principal ID.')
179-
principalType: ('ServicePrincipal' | 'Group' | 'User' | 'ForeignGroup' | 'Device')?
180-
181-
@description('Optional. The description of the role assignment.')
182-
description: string?
183-
184-
@description('Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container".')
185-
condition: string?
186-
187-
@description('Optional. Version of the condition.')
188-
conditionVersion: '2.0'?
189-
190-
@description('Optional. The Resource Id of the delegated managed identity resource.')
191-
delegatedManagedIdentityResourceId: string?
192-
}[]?

0 commit comments

Comments
 (0)