try number 2 for using keyvault

Tietokilta · Nov 7, 2023 · 2d586fd · 2d586fd
1 parent 75ab203
commit 2d586fd
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 12 deletions.
diff --git a/modules/common/main.tf b/modules/common/main.tf
@@ -52,7 +52,13 @@ resource "azurerm_postgresql_flexible_server" "tikweb_pg_new" {
   auto_grow_enabled            = false
   zone                         = "2"
 }
-
+# very secure accesses yes
+resource "azurerm_postgresql_flexible_server_firewall_rule" "tikweb_pg_new_firewall" {
+  name             = "tikweb-${var.env_name}-pg-new"
+  server_id        = azurerm_postgresql_flexible_server.tikweb_pg_new.id
+  start_ip_address = "0.0.0.0"
+  end_ip_address   = "0.0.0.0"
+}
 # Enable access from other Azure services
 resource "azurerm_postgresql_firewall_rule" "tikweb_pg_internal_access" {
   name                = "tikweb-${var.env_name}-pg-internal-access"

diff --git a/modules/keyvault/main.tf b/modules/keyvault/main.tf
@@ -13,11 +13,16 @@ resource "azurerm_key_vault" "keyvault" {
 
 
 }
+data "azuread_application" "CI_app_registration" {
+  display_name = "github-action-terraform"
+}
+
 
 resource "azurerm_key_vault_access_policy" "current" {
-  key_vault_id = azurerm_key_vault.keyvault.id
-  tenant_id    = data.azurerm_client_config.current.tenant_id
-  object_id    = data.azurerm_client_config.current.object_id
+  key_vault_id   = azurerm_key_vault.keyvault.id
+  tenant_id      = data.azurerm_client_config.current.tenant_id
+  object_id      = data.azuread_application.CI_app_registration.id
+  application_id = data.azuread_application.CI_app_registration.application_id
 
   key_permissions = [
     "Get",
@@ -80,53 +85,57 @@ data "azurerm_key_vault_secret" "strapi_api_token_salt" {
 data "azurerm_key_vault_secret" "strapi_app_keys" {
   name         = "strapi-app-keys"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_auth_jwt_secret" {
   name         = "ilmo-auth-jwt-secret"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_edit_token_secret" {
   name         = "ilmo-edit-token-secret"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_mailgun_api_key" {
   name         = "ilmo-mailgun-api-key"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "ilmo_mailgun_domain" {
   name         = "ilmo-mailgun-domain"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "tikjob_ghost_mail_username" {
   name         = "tikjob-ghost-mail-username"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "tikjob_ghost_mail_password" {
   name         = "tikjob-ghost-mail-password"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "tenttiarkisto_django_secret_key" {
   name         = "tenttiarkisto-django-secret-key"
   key_vault_id = azurerm_key_vault.keyvault.id
-  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
 
 data "azurerm_key_vault_secret" "github_app_key" {
   name         = "github-app-key"
   key_vault_id = azurerm_key_vault.keyvault.id
+}
+
+resource "azurerm_key_vault_secret" "postgres_admin_username" {
+  key_vault_id = azurerm_key_vault.keyvault.id
+  name         = "postgres-admin-username"
+  value        = var.tikweb_postgres_admin_username
+  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
+}
+resource "azurerm_key_vault_secret" "postgres_admin_password" {
+  key_vault_id = azurerm_key_vault.keyvault.id
+  name         = "postgres-admin-password"
+  value        = var.tikweb_postgres_admin_password
   depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }