-
Notifications
You must be signed in to change notification settings - Fork 4
/
disk-encryption.tf
45 lines (40 loc) · 1.13 KB
/
disk-encryption.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
resource "azurerm_key_vault_key" "des_key" {
key_opts = [
"decrypt",
"encrypt",
"sign",
"unwrapKey",
"verify",
"wrapKey",
]
key_type = "RSA-HSM"
key_vault_id = azurerm_key_vault.des_vault.id
name = "${var.cluster_name}-des-key"
expiration_date = timeadd("${formatdate("YYYY-MM-DD", timestamp())}T00:00:00Z", "168h")
key_size = 2048
depends_on = [
azurerm_key_vault_access_policy.current_user
]
lifecycle {
ignore_changes = [expiration_date]
}
}
resource "azurerm_disk_encryption_set" "des" {
key_vault_key_id = azurerm_key_vault_key.des_key.id
location = data.azurerm_resource_group.rg.location
name = "${var.cluster_name}-des"
resource_group_name = var.resource_group_name
identity {
type = "SystemAssigned"
}
}
resource "azurerm_key_vault_access_policy" "des" {
key_vault_id = azurerm_key_vault.des_vault.id
object_id = azurerm_disk_encryption_set.des.identity[0].principal_id
tenant_id = azurerm_disk_encryption_set.des.identity[0].tenant_id
key_permissions = [
"Get",
"WrapKey",
"UnwrapKey"
]
}