Key Vault

Overview

The KeyVault package contains four builders, for the different components used by KeyVault: One for access policies, one for secrets, one for the overall keyvault container, and one for adding access policies to an existing key vault.

• Keys (Microsoft.KeyVault/vaults/keys)
• KeyVault (Microsoft.KeyVault/vaults)
• Secrets (Microsoft.KeyVault/vaults/secrets)
• AccessPolicies (Microsoft.KeyVault/vaults/accessPolicies)

Key Builder

The key builder allows you to generate RSA and elliptical curve keys in the key vault.

Secret Builder

The secret builder allows you to store secrets into the key vault. Values for a secret are passed by Secure String parameters.

Access Policy Builder

The accessPolicy builder allows you to create access policies for the key vault.

Key Vault Builder

The keyVault builder contains access policies, secrets, and configuration information to create a full key vault account.

Key Vault Add Access Policy Builder (keyVaultAddPolicies)

As applications grow, more components often need access to a key vault. The keyVaultAddPolicies builder is used to add new access policies to an existing key vault without the need to redeploy the full key vault, potentially changing existing access.

Configuration Members

Utilities

• The KeyVault module comes with a set of utility functions to quickly create access policies if you do not wish to use the AccessPolicy builder, in the Farmer.KeyVault.AccessPolicy module which enables creating an access policy for a PrincipalId or an ObjectId which will have the GET Secret permission.
• In addition, the AccessPolicy module also contains helpers to search for users or groups in the active directory (requires Azure CLI installed), as well as their Object IDs. These can be used to rapidly create Access Policies for specific users.

Example

open Farmer
open Farmer.Builders
open Farmer.KeyVault
open System

let policy =
    accessPolicy {
        object_id Guid.Empty
        application_id Guid.Empty
        certificate_permissions [ KeyVault.Certificate.List ]
        secret_permissions KeyVault.Secret.All
        key_permissions [ KeyVault.Key.List ]
    }

let complexSecret = secret {
    name "myComplexSecret"
    content_type "application/text"
    status Enabled
    activation_date (DateTime.Today.AddDays -1.)
    expiration_date (DateTime.Today.AddDays 1.)
}

let vault =
    keyVault {
        name "MyVault"
        sku KeyVault.Sku.Standard
        tenant_id Guid.Empty

        enable_disk_encryption_access
        enable_resource_manager_access
        enable_soft_delete_with_purge_protection

        disable_vm_access
        enable_recovery_mode
        add_access_policy policy
        enable_azure_services_bypass

        add_ip_rule "127.0.0.1"
        add_vnet_rule "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1"
        allow_default_traffic

        add_secret complexSecret
        add_secret "simpleSecret"
        add_secrets [ "firstSecret"; "secondSecret"]
        add_keys [
            key {
                name "myRsaKey"
                key_type KeyType.RSA_4096
            }
            key {
                name "myRllipticalCurveKey"
                key_type KeyType.EC_P256
            }
        ]
    }

arm {
    add_resource vault
    output "vault-uri" vault.VaultUri
}