Locks down keyvaults to subnets and administrator ip addresses

2020-01-23 11:02:12 -05:00
parent c31d68a18c
commit dab6cdb7dc
4 changed files with 30 additions and 0 deletions
--- a/terraform/providers/dev/keyvault.tf
+++ b/terraform/providers/dev/keyvault.tf
@@ -7,5 +7,8 @@ module "keyvault" {
  tenant_id        = var.tenant_id
  principal_id     = "f9bcbe58-8b73-4957-aee2-133dc3e58063"
  admin_principals = var.admin_users
+  policy           = "Deny"
+  subnet_ids       = [module.vpc.subnets]
+  whitelist        = var.admin_user_whitelist
 }

--- a/terraform/providers/dev/secrets.tf
+++ b/terraform/providers/dev/secrets.tf
@@ -7,4 +7,7 @@ module "operator_keyvault" {
  tenant_id        = var.tenant_id
  principal_id     = ""
  admin_principals = var.admin_users
+  policy           = "Deny"
+  subnet_ids       = [module.vpc.subnets]
+  whitelist        = var.admin_user_whitelist
 }