Secrets Management — Animate | AI Wisdom

← Back to topic
🎞 ANIMATE · Mode 3 of 5 · +100 XP— Secrets Management in IaC
🔐Provision KV
🔑Grant RBAC
🔗Reference
💉Inject
📋Audit
🎯 Next: Test →
Step 1 / 5
Speed
Key Vault Provisioning
Provision Key Vault with RBAC and purge protection💡 Analogy
Key Vault is like a bank safety deposit room — multiple levels of protection, detailed access logs, and you need verified identity to get in.
Create Key Vault with enable_rbac_authorization=true (use RBAC roles instead of legacy access policies) and purge_protection_enabled=true (prevent accidental key vault deletion).
Console Output
$ terraform apply -target azurerm_key_vault.main

azurerm_key_vault.main: Creating...
azurerm_key_vault.main: Creation complete after 12s

Key Vault URI: https://kv-myapp-prod.vault.azure.net/
RBAC: Enabled
Purge Protection: Enabled
●secrets.tf
Key Vault ProvisioningL1–12
1# ── Provision Key Vault ──
2resource "azurerm_key_vault" "main" {
3  name                = "kv-myapp-prod"
4  resource_group_name = azurerm_resource_group.main.name
5  location            = azurerm_resource_group.main.location
6  tenant_id           = data.azurerm_client_config.current.tenant_id
7  sku_name            = "standard"
8 
9  enable_rbac_authorization = true   # Use RBAC, not access policies
10  purge_protection_enabled  = true   # Prevent accidental deletion
11  soft_delete_retention_days = 90
12}
13 
14# ── Grant App Service Managed Identity access ──
15resource "azurerm_role_assignment" "kv_secrets" {
16  scope                = azurerm_key_vault.main.id
17  role_definition_name = "Key Vault Secrets User"
18  principal_id         = azurerm_linux_web_app.app.identity[0].principal_id
19}
20 
21# ── Read existing secret (never hardcode in .tf) ──
22data "azurerm_key_vault_secret" "db_password" {
23  name         = "db-admin-password"
24  key_vault_id = azurerm_key_vault.main.id
25  depends_on   = [azurerm_role_assignment.kv_secrets]
26}
27 
28# ── Use KV reference in App Service (secret resolved at runtime) ──
29resource "azurerm_linux_web_app" "app" {
30  name                = "app-myapp-prod"
31  resource_group_name = azurerm_resource_group.main.name
32  location            = azurerm_resource_group.main.location
33  service_plan_id     = azurerm_service_plan.plan.id
34 
35  identity {
36    type = "SystemAssigned"
37  }
38 
39  app_settings = {
40    # KV Reference - secret resolved at runtime, not stored in state
41    DB_CONNECTION = "@Microsoft.KeyVault(VaultName=kv-myapp-prod;SecretName=db-admin-password)"
42  }
43}
43 lines
Timeline — 5 Steps
Key Vault Provisioning
Provision Key Vault with RBAC and purge protection💡 Analogy
Key Vault is like a bank safety deposit room — multiple levels of protection, detailed access logs, and you need verified identity to get in.
Create Key Vault with enable_rbac_authorization=true (use RBAC roles instead of legacy access policies) and purge_protection_enabled=true (prevent accidental key vault deletion).
Console Output
$ terraform apply -target azurerm_key_vault.main

azurerm_key_vault.main: Creating...
azurerm_key_vault.main: Creation complete after 12s

Key Vault URI: https://kv-myapp-prod.vault.azure.net/
RBAC: Enabled
Purge Protection: Enabled

Was this page helpful?

Discussion

Provision Key Vault with RBAC and purge protection

💡 Analogy

Key Vault is like a bank safety deposit room — multiple levels of protection, detailed access logs, and you need verified identity to get in.

Create Key Vault with enable_rbac_authorization=true (use RBAC roles instead of legacy access policies) and purge_protection_enabled=true (prevent accidental key vault deletion).

Console Output

$ terraform apply -target azurerm_key_vault.main

azurerm_key_vault.main: Creating...
azurerm_key_vault.main: Creation complete after 12s

Key Vault URI: https://kv-myapp-prod.vault.azure.net/
RBAC: Enabled
Purge Protection: Enabled

Provision Key Vault with RBAC and purge protection

💡 Analogy

Key Vault is like a bank safety deposit room — multiple levels of protection, detailed access logs, and you need verified identity to get in.

Create Key Vault with enable_rbac_authorization=true (use RBAC roles instead of legacy access policies) and purge_protection_enabled=true (prevent accidental key vault deletion).

Console Output

$ terraform apply -target azurerm_key_vault.main

azurerm_key_vault.main: Creating...
azurerm_key_vault.main: Creation complete after 12s

Key Vault URI: https://kv-myapp-prod.vault.azure.net/
RBAC: Enabled
Purge Protection: Enabled