azurermKeyVaultManagedStorageAccount
Manages a Key Vault Managed Storage Account.
Example Usage
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm.
For a more precise conversion please use the --provider flag in convert.*/
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
this,
"example",
{
location: "West Europe",
name: "example-resources",
}
);
const azurermStorageAccountExample = new azurerm.storageAccount.StorageAccount(
this,
"example_1",
{
account_replication_type: "LRS",
account_tier: "Standard",
location: azurermResourceGroupExample.location,
name: "storageaccountname",
resource_group_name: azurermResourceGroupExample.name,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermStorageAccountExample.overrideLogicalId("example");
const dataAzurermClientConfigCurrent =
new azurerm.dataAzurermClientConfig.DataAzurermClientConfig(
this,
"current",
{}
);
const azurermKeyVaultExample = new azurerm.keyVault.KeyVault(
this,
"example_3",
{
access_policy: [
{
object_id: dataAzurermClientConfigCurrent.objectId,
secret_permissions: ["Get", "Delete"],
storage_permissions: [
"Get",
"List",
"Set",
"SetSAS",
"GetSAS",
"DeleteSAS",
"Update",
"RegenerateKey",
],
tenant_id: dataAzurermClientConfigCurrent.tenantId,
},
],
location: azurermResourceGroupExample.location,
name: "",
resource_group_name: azurermResourceGroupExample.name,
sku_name: "standard",
tenant_id: dataAzurermClientConfigCurrent.tenantId,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermKeyVaultExample.overrideLogicalId("example");
const azurermKeyVaultManagedStorageAccountExample =
new azurerm.keyVaultManagedStorageAccount.KeyVaultManagedStorageAccount(
this,
"example_4",
{
key_vault_id: azurermKeyVaultExample.id,
name: "examplemanagedstorage",
regenerate_key_automatically: false,
regeneration_period: "P1D",
storage_account_id: azurermStorageAccountExample.id,
storage_account_key: "key1",
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermKeyVaultManagedStorageAccountExample.overrideLogicalId("example");
Example Usage (automatically regenerate Storage Account access key)
/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as azurerm from "./.gen/providers/azurerm";
import * as azuread from "./.gen/providers/azuread";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: azurerm, azuread.
For a more precise conversion please use the --provider flag in convert.*/
const azurermResourceGroupExample = new azurerm.resourceGroup.ResourceGroup(
this,
"example",
{
location: "West Europe",
name: "example-resources",
}
);
const azurermStorageAccountExample = new azurerm.storageAccount.StorageAccount(
this,
"example_1",
{
account_replication_type: "LRS",
account_tier: "Standard",
location: azurermResourceGroupExample.location,
name: "storageaccountname",
resource_group_name: azurermResourceGroupExample.name,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermStorageAccountExample.overrideLogicalId("example");
const dataAzureadServicePrincipalTest =
new azuread.dataAzureadServicePrincipal.DataAzureadServicePrincipal(
this,
"test",
{
application_id: "cfa8b339-82a2-471a-a3c9-0fc0be7a4093",
}
);
const dataAzurermClientConfigCurrent =
new azurerm.dataAzurermClientConfig.DataAzurermClientConfig(
this,
"current",
{}
);
const azurermKeyVaultExample = new azurerm.keyVault.KeyVault(
this,
"example_4",
{
access_policy: [
{
object_id: dataAzurermClientConfigCurrent.objectId,
secret_permissions: ["Get", "Delete"],
storage_permissions: [
"Get",
"List",
"Set",
"SetSAS",
"GetSAS",
"DeleteSAS",
"Update",
"RegenerateKey",
],
tenant_id: dataAzurermClientConfigCurrent.tenantId,
},
],
location: azurermResourceGroupExample.location,
name: "",
resource_group_name: azurermResourceGroupExample.name,
sku_name: "standard",
tenant_id: dataAzurermClientConfigCurrent.tenantId,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermKeyVaultExample.overrideLogicalId("example");
const azurermRoleAssignmentExample = new azurerm.roleAssignment.RoleAssignment(
this,
"example_5",
{
principal_id: dataAzureadServicePrincipalTest.id,
role_definition_name: "Storage Account Key Operator Service Role",
scope: azurermStorageAccountExample.id,
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermRoleAssignmentExample.overrideLogicalId("example");
const azurermKeyVaultManagedStorageAccountExample =
new azurerm.keyVaultManagedStorageAccount.KeyVaultManagedStorageAccount(
this,
"example_6",
{
depends_on: [`\${${azurermRoleAssignmentExample.fqn}}`],
key_vault_id: azurermKeyVaultExample.id,
name: "examplemanagedstorage",
regenerate_key_automatically: true,
regeneration_period: "P1D",
storage_account_id: azurermStorageAccountExample.id,
storage_account_key: "key1",
}
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
azurermKeyVaultManagedStorageAccountExample.overrideLogicalId("example");
Arguments Reference
The following arguments are supported:
-
name- (Required) The name which should be used for this Key Vault Managed Storage Account. Changing this forces a new Key Vault Managed Storage Account to be created. -
keyVaultId- (Required) The ID of the Key Vault where the Managed Storage Account should be created. Changing this forces a new resource to be created. -
storageAccountId- (Required) The ID of the Storage Account. -
storageAccountKey- (Required) Which Storage Account access key that is managed by Key Vault. Possible values arekey1andkey2.
regenerateKeyAutomatically- (Optional) Should Storage Account access key be regenerated periodically?
\~> NOTE: Azure Key Vault application needs to have access to Storage Account for auto regeneration to work. Example can be found above.
-
regenerationPeriod- (Optional) How often Storage Account access key should be regenerated. Value needs to be in ISO 8601 duration format. -
tags- (Optional) A mapping of tags which should be assigned to the Key Vault Managed Storage Account. Changing this forces a new resource to be created.
Attributes Reference
In addition to the Arguments listed above - the following Attributes are exported:
id- The ID of the Key Vault Managed Storage Account.
Timeouts
The timeouts block allows you to specify timeouts for certain actions:
create- (Defaults to 30 minutes) Used when creating the Key Vault Managed Storage Account.read- (Defaults to 5 minutes) Used when retrieving the Key Vault Managed Storage Account.update- (Defaults to 30 minutes) Used when updating the Key Vault Managed Storage Account.delete- (Defaults to 30 minutes) Used when deleting the Key Vault Managed Storage Account.
Import
Key Vault Managed Storage Accounts can be imported using the resourceId, e.g.