Disk Encryption Set with CMK

disk_encryption_sets.tf

@@ -0,0 +1,15 @@
+module "disk_encryption_sets" {
+  source   = "./modules/security/disk_encryption_set"
+  for_each = local.security.disk_encryption_sets
+
+  global_settings    = local.global_settings
+  client_config      = local.client_config
+  settings           = each.value
+  resource_groups    = module.resource_groups
+  base_tags          = try(local.global_settings.inherit_tags, false) ? module.resource_groups[each.value.resource_group_key].tags : {}
+  key_vault_key_ids  = module.keyvault_keys
+}
+
+output disk_encryption_sets {
+  value = module.disk_encryption_sets
+}

keyvault.tf

@@ -32,6 +32,7 @@ module "keyvault_access_policies" {
   managed_identities                = local.combined_objects_managed_identities
   mssql_managed_instances           = local.combined_objects_mssql_managed_instances
   mssql_managed_instances_secondary = local.combined_objects_mssql_managed_instances_secondary
+  disk_encryption_sets              = local.combined_objects_disk_encryption_sets
 }
 
 

locals.combined_objects.tf

@@ -35,4 +35,5 @@ locals {
   combined_objects_resource_groups                   = merge(tomap({ (local.client_config.landingzone_key) = module.resource_groups }), try(var.remote_objects.resource_groups, {}))
   combined_objects_storage_accounts                  = merge(tomap({ (local.client_config.landingzone_key) = module.storage_accounts }), try(var.remote_objects.storage_accounts, {}))
   combined_objects_synapse_workspaces                = merge(tomap({ (local.client_config.landingzone_key) = module.synapse_workspaces }), try(var.remote_objects.synapse_workspaces, {}))
+  combined_objects_disk_encryption_sets              = merge(tomap({ (local.client_config.landingzone_key) = module.disk_encryption_sets }), try(var.remote_objects.disk_encryption_sets, {}))
 }

locals.tf

@@ -34,6 +34,7 @@ locals {
     keyvault_certificate_requests = try(var.security.keyvault_certificate_requests, {})
     keyvault_certificates         = try(var.security.keyvault_certificates, {})
     keyvault_keys                 = try(var.security.keyvault_keys, {})
+    disk_encryption_sets          = try(var.security.disk_encryption_sets, {})
   }
 
   networking = {

modules/compute/virtual_machine/variables.tf

@@ -60,3 +60,7 @@ variable base_tags {
 variable proximity_placement_groups {
   default = {}
 }
+
+variable disk_encryption_sets {
+  default = {}
+}

modules/compute/virtual_machine/vm_linux.tf

@@ -83,6 +83,7 @@ resource "azurerm_linux_virtual_machine" "vm" {
     name                      = try(azurecaf_name.os_disk_linux[each.key].result, null)
     storage_account_type      = try(each.value.os_disk.storage_account_type, null)
     write_accelerator_enabled = try(each.value.os_disk.write_accelerator_enabled, false)
+    disk_encryption_set_id    = try(each.value.os_disk.disk_encryption_set_key, null) == null ? null : try(var.disk_encryption_sets[var.client_config.landingzone_key][each.value.os_disk.disk_encryption_set_key], var.disk_encryption_sets[each.value.os_disk.lz_key][each.value.os_disk.disk_encryption_set_key] ,null)
   }
 
   source_image_reference {

modules/compute/virtual_machine/vm_windows.tf

@@ -68,6 +68,7 @@ resource "azurerm_windows_virtual_machine" "vm" {
     name                      = azurecaf_name.os_disk_windows[each.key].result
     storage_account_type      = each.value.os_disk.storage_account_type
     write_accelerator_enabled = try(each.value.os_disk.write_accelerator_enabled, false)
+    disk_encryption_set_id    = try(each.value.os_disk.disk_encryption_set_key, null) == null ? null : try(var.disk_encryption_sets[var.client_config.landingzone_key][each.value.os_disk.disk_encryption_set_key], var.disk_encryption_sets[each.value.os_disk.lz_key][each.value.os_disk.disk_encryption_set_key] ,null)
 
     dynamic "diff_disk_settings" {
       for_each = try(each.value.diff_disk_settings, false) == false ? [] : [1]

modules/security/disk_encryption_set/disk_encryption_set.tf

@@ -0,0 +1,11 @@
+resource "azurerm_disk_encryption_set" "encryption_set" {
+  name                = var.settings.name
+  resource_group_name = var.resource_groups[var.settings.resource_group_key].name
+  location            = lookup(var.settings, "region", null) == null ? var.resource_groups[var.settings.resource_group_key].location : var.global_settings.regions[var.settings.region]
+  key_vault_key_id    = var.key_vault_key_ids[var.settings.key_vault_key_key].id
+
+  identity {
+    type = "SystemAssigned"
+  }
+  tags = merge(var.base_tags, try(var.settings.tags, null))
+}

modules/security/disk_encryption_set/main.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    azurecaf = {
+      source = "aztfmod/azurecaf"
+    }
+  }
+  required_version = ">= 0.13"
+}

modules/security/disk_encryption_set/output.tf

@@ -0,0 +1,14 @@
+output principal_id {
+  value = azurerm_disk_encryption_set.encryption_set.identity.0.principal_id
+}
+output tenant_id {
+  value = azurerm_disk_encryption_set.encryption_set.identity.0.tenant_id
+}
+
+output id {
+  value = azurerm_disk_encryption_set.encryption_set.id
+}
+
+output rbac_id {
+  value = azurerm_disk_encryption_set.encryption_set.identity.0.principal_id
+}

modules/security/disk_encryption_set/variables.tf

@@ -0,0 +1,8 @@
+variable global_settings {}
+variable client_config {}
+variable base_tags {
+  default = {}
+}
+variable settings {}
+variable key_vault_key_ids {}
+variable resource_groups {}

modules/security/keyvault_access_policies/policies.tf

@@ -103,3 +103,15 @@ module mssql_managed_instances_secondary {
   object_id     = try(each.value.lz_key, null) == null ? var.mssql_managed_instances_secondary[var.client_config.landingzone_key][each.value.mssql_managed_instance_secondary_key].principal_id : var.mssql_managed_instances_secondary[each.value.lz_key][each.value.mssql_managed_instance_secondary_key].principal_id
 }
 
+module disk_encryption_set {
+  source = "./access_policy"
+  for_each = {
+    for key, access_policy in var.access_policies : key => access_policy
+    if try(access_policy.disk_encryption_set_key, null) != null
+  }
+
+  keyvault_id   = var.keyvault_id == null ? try(var.keyvaults[var.client_config.landingzone_key][var.keyvault_key].id, var.keyvaults[each.value.lz_key][var.keyvault_key].id) : var.keyvault_id
+  access_policy = each.value
+  tenant_id     = var.client_config.tenant_id
+  object_id     = try(each.value.lz_key, null) == null ? var.disk_encryption_sets[var.client_config.landingzone_key][each.value.disk_encryption_set_key].principal_id : var.disk_encryption_sets[each.value.lz_key][each.value.disk_encryption_set_key].principal_id
+}

modules/security/keyvault_access_policies/variables.tf

@@ -32,4 +32,7 @@ variable mssql_managed_instances {
 }
 variable mssql_managed_instances_secondary {
   default = {}
+}
+variable disk_encryption_sets {
+  default = {}
 }

virtual_machines.tf

@@ -26,6 +26,7 @@ module virtual_machines {
   base_tags                        = try(local.global_settings.inherit_tags, false) ? module.resource_groups[each.value.resource_group_key].tags : {}
   availability_sets                = local.combined_objects_availability_sets
   proximity_placement_groups       = local.combined_objects_proximity_placement_groups
+  disk_encryption_sets             = local.combined_objects_disk_encryption_sets
 }