Key Vault¶

Creates a Key Vault hardened by default: RBAC authorization, soft delete with 90 day retention, purge protection, public network access disabled and network ACLs defaulting to deny. Intended to be reached over a private endpoint.

Summary¶

Hardened, RBAC-authorized Key Vault with public network access disabled.

Module Information¶

Property	Value
Owner	platform-team
Support	Support
Version	1.0.0

Resource Types¶

Resource Type
`Microsoft.Authorization/roleAssignments`
`Microsoft.Insights/diagnosticSettings`
`Microsoft.KeyVault/vaults`

Usage¶

module vault 'br:geitbicepmodweucr01.azurecr.io/bicep/modules/key-vault/vault:1.0.0' = {
  name: 'vault'
  params: {
    // Required parameters
    par_key_vault_name: <string>
  }
}

Parameters¶

Name	Type	Description	Default
`par_diagnostic_settings`	`array`	Optional. Diagnostic settings to attach to the vault. Each entry targets a Log Analytics workspace and enables at least one log or metric category; entries with neither are skipped, because ARM rejects an empty diagnosticSettings.	``
`par_enable_purge_protection`	`bool`	Whether purge protection is enabled. Defaults to true per WAF Security pillar. Purge protection cannot be turned off once enabled, so the property is omitted rather than set to false when this is false.	`True`
`par_enable_rbac_authorization`	`bool`	Whether the vault uses Azure RBAC instead of access policies. Defaults to true per WAF Security pillar.	`True`
`par_enable_soft_delete`	`bool`	Whether soft delete is enabled. Defaults to true. The service no longer allows disabling it on new vaults.	`True`
`par_enabled_for_deployment`	`bool`	Whether Azure Virtual Machines may retrieve certificates from the vault. Defaults to false per WAF Security pillar.	`False`
`par_enabled_for_disk_encryption`	`bool`	Whether Azure Disk Encryption may retrieve secrets from the vault. Defaults to false per WAF Security pillar.	`False`
`par_enabled_for_template_deployment`	`bool`	Whether ARM may retrieve secrets from the vault during template deployment. Defaults to false per WAF Security pillar.	`False`
`par_key_vault_name`	`string`	Name of the Key Vault. Must be globally unique, 3 to 24 characters, alphanumerics and hyphens.	required
`par_location`	`string`	Azure region for the vault. Defaults to the resource group location.	`[resourceGroup().location]`
`par_network_acls`	`networkAclsType`	Network ACLs for the vault. Defaults to deny-by-default with trusted Azure services bypassed.	`@{bypass=AzureServices; defaultAction=Deny; ipRules=System.Object[]; virtualNetworkRules=System.Object[]}`
`par_public_network_access`	`string`	Whether the vault is reachable from the public internet. Defaults to Disabled per WAF Security pillar, which means consumers reach it over a private endpoint.	`Disabled`
`par_role_assignments`	`array`	Optional. Role assignments applied to the vault. Grant Key Vault Secrets User (4633458b-17de-408a-b874-0445c86b69e6) to the identity the pipeline agents use.	``
`par_sku_name`	`string`	SKU of the vault. Defaults to standard. Use premium only when HSM-backed keys are required.	`standard`
`par_soft_delete_retention_in_days`	`int`	Soft delete retention in days. Defaults to 90, the maximum.	`90`
`par_tags`	`object`	Resource tags applied to the vault.	``
`par_tenant_id`	`string`	Microsoft Entra tenant ID used for authentication. Defaults to the deploying tenant.	`[tenant().tenantId]`

Outputs¶

Name	Type	Description
`out_key_vault_id`	`string`	Resource ID of the deployed Key Vault.
`out_key_vault_name`	`string`	Name of the deployed Key Vault.
`out_key_vault_uri`	`string`	DNS name of the deployed Key Vault.

Versions¶

Pin an exact version. Ranges are not supported.

Version	Reference
`1.0.0` (latest)	`br/Euvic-Modules:key-vault/vault:1.0.0`