fix NSG, fix key vault expiry

Signed-off-by: Andre Licht <al@cloudeteer.de>

Author: lixhunter

.trivyignore

@@ -0,0 +1,4 @@
+# AVD-AZU-0068 / AZU-0068
+# Module-managed NICs are always associated with an NSG in r-network.tf.
+# This generic module also supports externally supplied NIC IDs, which are consumer-managed.
+AZU-0068

README.md

@@ -23,7 +23,7 @@ As documented on the [image](#input_image) input variable, it is possible to use
 This example demonstrates the usage of the virtual machine module with default settings. It sets up all necessary dependencies, including a resource group, virtual network, subnet, recovery services vault, backup policy, and key vault, to ensure seamless deployment.
 
 > [!TIP]
-> Our module enables password-based login for Linux virtual machines, configurable via the `authentication_type` input variable. If the [`disable_password_authentication`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine.html#disable_password_authentication-1) setting on the [`azurerm_linux_virtual_machine`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) resource within this module is not explicitly set to `false`, [Trivy](https://trivy.dev) will flag a high-severity warning. To suppress this warning, add the comment `#trivy:ignore:avd-azu-0039` directly above the Terraform module definition, as shown in the example below.
+> Our module intentionally keeps password-based login available for Linux virtual machines through the `authentication_type` input variable. Where your security policy requires SSH-only access, set `authentication_type = "SSH"`. When you intentionally allow Linux password authentication and need to suppress the corresponding [Trivy](https://trivy.dev) warning, add the comment `#trivy:ignore:AVD-AZU-0039` directly above the Terraform module definition, as shown in the example below.
 
 ```hcl
 resource "azurerm_resource_group" "example" {
@@ -94,7 +94,9 @@ resource "azurerm_key_vault" "example" {
   }
 }
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 
@@ -134,6 +136,8 @@ The following resources are used by this module:
 - [azurerm_linux_virtual_machine.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) (resource)
 - [azurerm_managed_disk.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk) (resource)
 - [azurerm_network_interface.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface) (resource)
+- [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) (resource)
+- [azurerm_network_security_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) (resource)
 - [azurerm_public_ip.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) (resource)
 - [azurerm_role_assignment.entra_id_login_admin](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.entra_id_login_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
@@ -610,6 +614,17 @@ Type: `string`
 
 Default: `null`
 
+### <a name="input_key_vault_secret_expiration_date"></a> [key\_vault\_secret\_expiration\_date](#input\_key\_vault\_secret\_expiration\_date)
+
+Description: The RFC3339 timestamp to assign as `expiration_date` on generated Azure Key Vault secrets.
+
+- Applies only when `store_secret_in_key_vault` is `true`.
+- Leave as `null` to keep generated secrets without an explicit expiry date.
+
+Type: `string`
+
+Default: `null`
+
 ### <a name="input_license_type"></a> [license\_type](#input\_license\_type)
 
 Description: Specifies the license type to be used for this Virtual Machine.
@@ -631,6 +646,17 @@ Type: `list(string)`
 
 Default: `null`
 
+### <a name="input_network_security_group_id"></a> [network\_security\_group\_id](#input\_network\_security\_group\_id)
+
+Description: The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
+
+- Applies only when `create_network_interface` is `true`.
+- If omitted and `create_network_interface` is `true`, this module creates and associates a default Network Security Group.
+
+Type: `string`
+
+Default: `null`
+
 ### <a name="input_operating_system"></a> [operating\_system](#input\_operating\_system)
 
 Description: The virtual machine's operating system. Valid values are `Linux` or `Windows`. The default is `null`, which determines the operating system to use based on the virtual machine image offering.

examples/domain_join/main.tf

@@ -86,7 +86,9 @@ data "azurerm_key_vault_secret" "domain_join_user" {
 }
 
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 

examples/external_key_vault/main.tf

@@ -27,7 +27,9 @@ variable "location" {
   type = string
 }
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 

examples/usage/main.md

@@ -1,4 +1,4 @@
 This example demonstrates the usage of the virtual machine module with default settings. It sets up all necessary dependencies, including a resource group, virtual network, subnet, recovery services vault, backup policy, and key vault, to ensure seamless deployment.
 
 > [!TIP]
-> Our module enables password-based login for Linux virtual machines, configurable via the `authentication_type` input variable. If the [`disable_password_authentication`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine.html#disable_password_authentication-1) setting on the [`azurerm_linux_virtual_machine`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) resource within this module is not explicitly set to `false`, [Trivy](https://trivy.dev) will flag a high-severity warning. To suppress this warning, add the comment `#trivy:ignore:avd-azu-0039` directly above the Terraform module definition, as shown in the example below.
+> Our module intentionally keeps password-based login available for Linux virtual machines through the `authentication_type` input variable. Where your security policy requires SSH-only access, set `authentication_type = "SSH"`. When you intentionally allow Linux password authentication and need to suppress the corresponding [Trivy](https://trivy.dev) warning, add the comment `#trivy:ignore:AVD-AZU-0039` directly above the Terraform module definition, as shown in the example below.

examples/usage/main.tf

@@ -66,7 +66,9 @@ resource "azurerm_key_vault" "example" {
   }
 }
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 

r-authentication.tf

@@ -27,15 +27,18 @@ resource "tls_private_key" "this" {
   rsa_bits  = var.admin_ssh_key_algorithm == "RSA" ? 4096 : null
 }
 
-#trivy:ignore:avd-azu-0017
-#trivy:ignore:avd-azu-0013
+# Generated secrets may intentionally remain non-expiring when rotation is managed externally.
+# Set var.key_vault_secret_expiration_date to enforce an explicit expiry date on generated secrets.
+#trivy:ignore:AVD-AZU-0017
+#trivy:ignore:AVD-AZU-0013
 resource "azurerm_key_vault_secret" "this" {
   for_each = toset([
     for element in split(", ", var.authentication_type) : element if var.store_secret_in_key_vault
   ])
 
-  name         = "${var.name}-${var.admin_username}-${lower(each.key)}"
-  content_type = var.authentication_type
-  key_vault_id = var.key_vault_id
-  value        = coalesce(local.admin_password, local.admin_ssh_private_key)
+  name            = "${var.name}-${var.admin_username}-${lower(each.key)}"
+  content_type    = var.authentication_type
+  expiration_date = var.key_vault_secret_expiration_date
+  key_vault_id    = var.key_vault_id
+  value           = coalesce(local.admin_password, local.admin_ssh_private_key)
 }

r-network.tf

@@ -3,7 +3,22 @@ locals {
     azurerm_network_interface.this[*].id,
     (var.network_interface_ids != null ? var.network_interface_ids : [])
   )
+  network_security_group_id = (
+    var.network_security_group_id != null ?
+    var.network_security_group_id :
+    try(one(azurerm_network_security_group.this[*].id), null)
+  )
+
+}
 
+resource "azurerm_network_security_group" "this" {
+
+  count = var.create_network_interface && var.network_security_group_id == null ? 1 : 0
+
+  name                = "nsg-${trimprefix(var.name, "vm-")}"
+  location            = var.location
+  resource_group_name = var.resource_group_name
+  tags                = var.tags
 }
 
 resource "azurerm_network_interface" "this" {
@@ -26,6 +41,13 @@ resource "azurerm_network_interface" "this" {
   }
 }
 
+resource "azurerm_network_interface_security_group_association" "this" {
+  count = var.create_network_interface ? 1 : 0
+
+  network_interface_id      = azurerm_network_interface.this[0].id
+  network_security_group_id = local.network_security_group_id
+}
+
 resource "azurerm_public_ip" "this" {
   count = var.create_public_ip_address ? 1 : 0
 

r-vm.tf

@@ -9,7 +9,11 @@ locals {
   )
 }
 
-# trivy:ignore:avd-azu-0039
+# Module-managed NICs are associated with an NSG in r-network.tf; externally supplied NICs remain consumer-managed.
+#trivy:ignore:AVD-AZU-0068
+# Linux password authentication remains an explicit module feature controlled by var.authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 resource "azurerm_linux_virtual_machine" "this" {
   count = local.is_linux ? 1 : 0
 
@@ -113,6 +117,8 @@ resource "azurerm_linux_virtual_machine" "this" {
 }
 
 resource "azurerm_windows_virtual_machine" "this" {
+  # Module-managed NICs are associated with an NSG in r-network.tf; externally supplied NICs remain consumer-managed.
+  #trivy:ignore:AVD-AZU-0068
   count = local.is_windows ? 1 : 0
 
   name                = var.name

tests/examples/mocks/azurerm_network_interface_security_group_association.tfmock.hcl

@@ -0,0 +1,5 @@
+mock_resource "azurerm_network_interface_security_group_association" {
+  defaults = {
+    id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkInterfaces/NIC-MOCK|/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkSecurityGroups/NSG-MOCK"
+  }
+}