Merge pull request #1332 from robgil-dds/170237669-use-keyvault-for-postgres-secrets

170237669 - Converts postgres secrets to use keyvault

terraform/modules/postgres/variables.tf

@@ -75,13 +75,11 @@ variable "storage_auto_grow" {
 variable "administrator_login" {
   type        = string
   description = "Administrator login"
-  default     = "atat_master" # FIXME - Remove with wrapper using KeyVault
 }
 
 variable "administrator_login_password" {
   type        = string
   description = "Administrator password"
-  default     = "eI0l7yswwtuhHpwzoVjwRKdAcuGNsg" # FIXME - Remove with wrapper using KeyVault
 }
 
 variable "postgres_version" {

terraform/providers/dev/postgres.tf

@@ -1,8 +1,20 @@
-module "sql" {
+data "azurerm_key_vault_secret" "postgres_username" {
-  source      = "../../modules/postgres"
+  name         = "postgres-root-user"
-  name        = var.name
+  key_vault_id = module.operator_keyvault.id
-  owner       = var.owner
+}
-  environment = var.environment
+
-  region      = var.region
+data "azurerm_key_vault_secret" "postgres_password" {
-  subnet_id   = module.vpc.subnets # FIXME - Should be a map of subnets and specify private
+  name         = "postgres-root-password"
+  key_vault_id = module.operator_keyvault.id
+}
+
+module "sql" {
+  source                       = "../../modules/postgres"
+  name                         = var.name
+  owner                        = var.owner
+  environment                  = var.environment
+  region                       = var.region
+  subnet_id                    = module.vpc.subnets # FIXME - Should be a map of subnets and specify private
+  administrator_login          = data.azurerm_key_vault_secret.postgres_username.value
+  administrator_login_password = data.azurerm_key_vault_secret.postgres_password.value
 }

terraform/providers/dev/secrets.tf

@@ -0,0 +1,10 @@
+module "operator_keyvault" {
+  source           = "../../modules/keyvault"
+  name             = "operator"
+  region           = var.region
+  owner            = var.owner
+  environment      = var.environment
+  tenant_id        = var.tenant_id
+  principal_id     = ""
+  admin_principals = var.admin_users
+}