try number 2 for using keyvault

Tietokilta · Nov 7, 2023 · 3373a74 · 3373a74
1 parent 75ab203
commit 3373a74
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 2 deletions.
diff --git a/modules/common/main.tf b/modules/common/main.tf
@@ -52,7 +52,13 @@ resource "azurerm_postgresql_flexible_server" "tikweb_pg_new" {
   auto_grow_enabled            = false
   zone                         = "2"
 }
-
+# very secure accesses yes
+resource "azurerm_postgresql_flexible_server_firewall_rule" "tikweb_pg_new_firewall" {
+  name             = "tikweb-${var.env_name}-pg-new"
+  server_id        = azurerm_postgresql_flexible_server.tikweb_pg_new.id
+  start_ip_address = "0.0.0.0"
+  end_ip_address   = "0.0.0.0"
+}
 # Enable access from other Azure services
 resource "azurerm_postgresql_firewall_rule" "tikweb_pg_internal_access" {
   name                = "tikweb-${var.env_name}-pg-internal-access"

diff --git a/modules/keyvault/main.tf b/modules/keyvault/main.tf
@@ -13,11 +13,15 @@ resource "azurerm_key_vault" "keyvault" {
 
 
 }
+data "azuread_application" "CI_app_registration" {
+  display_name = "github-action-terraform"
+}
+
 
 resource "azurerm_key_vault_access_policy" "current" {
   key_vault_id = azurerm_key_vault.keyvault.id
   tenant_id    = data.azurerm_client_config.current.tenant_id
-  object_id    = data.azurerm_client_config.current.object_id
+  object_id    = data.azuread_application.CI_app_registration.id
 
   key_permissions = [
     "Get",
@@ -130,3 +134,16 @@ data "azurerm_key_vault_secret" "github_app_key" {
   key_vault_id = azurerm_key_vault.keyvault.id
   depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
 }
+
+resource "azurerm_key_vault_secret" "postgres_admin_username" {
+  key_vault_id = azurerm_key_vault.keyvault.id
+  name         = "postgres-admin-username"
+  value        = var.tikweb_postgres_admin_username
+  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
+}
+resource "azurerm_key_vault_secret" "postgres_admin_password" {
+  key_vault_id = azurerm_key_vault.keyvault.id
+  name         = "postgres-admin-password"
+  value        = var.tikweb_postgres_admin_password
+  depends_on   = [azurerm_key_vault_access_policy.admin, azurerm_key_vault_access_policy.current]
+}
diff --git a/modules/keyvault/output.tf b/modules/keyvault/output.tf
@@ -44,3 +44,9 @@ output "tenttiarkisto_django_secret_key" {
 output "github_app_key" {
   value = data.azurerm_key_vault_secret.github_app_key.value
 }
+output "tikweb_postgres_admin_password" {
+  value = azurerm_key_vault_secret.postgres_admin_password
+}
+output "tikweb_postgres_admin_username" {
+  value = azurerm_key_vault_secret.postgres_admin_username
+}