fix trivy issues: NSG, key vault expiry (#96)

lixhunter · web-flow · commit 8b2b3de75fe3 · 2026-06-01T10:08:17.000+02:00
Signed-off-by: Andre Licht &lt;al@cloudeteer.de&gt;
diff --git a/.trivyignore b/.trivyignore
@@ -0,0 +1,4 @@
+# AVD-AZU-0068 / AZU-0068
+# Module-managed NICs are always associated with an NSG in r-network.tf.
+# This generic module also supports externally supplied NIC IDs, which are consumer-managed.
+AZU-0068
diff --git a/README.md b/README.md
@@ -23,7 +23,7 @@ As documented on the [image](#input_image) input variable, it is possible to use
 This example demonstrates the usage of the virtual machine module with default settings. It sets up all necessary dependencies, including a resource group, virtual network, subnet, recovery services vault, backup policy, and key vault, to ensure seamless deployment.
 
 > [!TIP]
-> Our module enables password-based login for Linux virtual machines, configurable via the `authentication_type` input variable. If the [`disable_password_authentication`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine.html#disable_password_authentication-1) setting on the [`azurerm_linux_virtual_machine`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) resource within this module is not explicitly set to `false`, [Trivy](https://trivy.dev) will flag a high-severity warning. To suppress this warning, add the comment `#trivy:ignore:avd-azu-0039` directly above the Terraform module definition, as shown in the example below.
+> Our module intentionally keeps password-based login available for Linux virtual machines through the `authentication_type` input variable. Where your security policy requires SSH-only access, set `authentication_type = "SSH"`. When you intentionally allow Linux password authentication and need to suppress the corresponding [Trivy](https://trivy.dev) warning, add the comment `#trivy:ignore:AVD-AZU-0039` directly above the Terraform module definition, as shown in the example below.
 
 ```hcl
 resource "azurerm_resource_group" "example" {
@@ -94,7 +94,9 @@ resource "azurerm_key_vault" "example" {
   }
 }
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 
@@ -134,6 +136,8 @@ The following resources are used by this module:
 - [azurerm_linux_virtual_machine.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) (resource)
 - [azurerm_managed_disk.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk) (resource)
 - [azurerm_network_interface.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface) (resource)
+- [azurerm_network_interface_security_group_association.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface_security_group_association) (resource)
+- [azurerm_network_security_group.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_security_group) (resource)
 - [azurerm_public_ip.this](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip) (resource)
 - [azurerm_role_assignment.entra_id_login_admin](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
 - [azurerm_role_assignment.entra_id_login_user](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) (resource)
@@ -610,6 +614,17 @@ Type: `string`
 
 Default: `null`
 
+### <a name="input_key_vault_secret_expiration_date"></a> [key\_vault\_secret\_expiration\_date](#input\_key\_vault\_secret\_expiration\_date)
+
+Description: The RFC3339 timestamp to assign as `expiration_date` on generated Azure Key Vault secrets.
+
+- Applies only when `store_secret_in_key_vault` is `true`.
+- Leave as `null` to keep generated secrets without an explicit expiry date.
+
+Type: `string`
+
+Default: `null`
+
 ### <a name="input_license_type"></a> [license\_type](#input\_license\_type)
 
 Description: Specifies the license type to be used for this Virtual Machine.
@@ -631,6 +646,17 @@ Type: `list(string)`
 
 Default: `null`
 
+### <a name="input_network_security_group_id"></a> [network\_security\_group\_id](#input\_network\_security\_group\_id)
+
+Description: The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
+
+- Applies only when `create_network_interface` is `true`.
+- If omitted and `create_network_interface` is `true`, this module creates and associates a default Network Security Group.
+
+Type: `string`
+
+Default: `null`
+
 ### <a name="input_operating_system"></a> [operating\_system](#input\_operating\_system)
 
 Description: The virtual machine's operating system. Valid values are `Linux` or `Windows`. The default is `null`, which determines the operating system to use based on the virtual machine image offering.
diff --git a/examples/domain_join/main.tf b/examples/domain_join/main.tf
@@ -86,7 +86,9 @@ data "azurerm_key_vault_secret" "domain_join_user" {
 }
 
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 
diff --git a/examples/external_key_vault/main.tf b/examples/external_key_vault/main.tf
@@ -27,7 +27,9 @@ variable "location" {
   type = string
 }
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 
diff --git a/examples/usage/main.md b/examples/usage/main.md
@@ -1,4 +1,4 @@
 This example demonstrates the usage of the virtual machine module with default settings. It sets up all necessary dependencies, including a resource group, virtual network, subnet, recovery services vault, backup policy, and key vault, to ensure seamless deployment.
 
 > [!TIP]
-> Our module enables password-based login for Linux virtual machines, configurable via the `authentication_type` input variable. If the [`disable_password_authentication`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine.html#disable_password_authentication-1) setting on the [`azurerm_linux_virtual_machine`](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) resource within this module is not explicitly set to `false`, [Trivy](https://trivy.dev) will flag a high-severity warning. To suppress this warning, add the comment `#trivy:ignore:avd-azu-0039` directly above the Terraform module definition, as shown in the example below.
+> Our module intentionally keeps password-based login available for Linux virtual machines through the `authentication_type` input variable. Where your security policy requires SSH-only access, set `authentication_type = "SSH"`. When you intentionally allow Linux password authentication and need to suppress the corresponding [Trivy](https://trivy.dev) warning, add the comment `#trivy:ignore:AVD-AZU-0039` directly above the Terraform module definition, as shown in the example below.
diff --git a/examples/usage/main.tf b/examples/usage/main.tf
@@ -66,7 +66,9 @@ resource "azurerm_key_vault" "example" {
   }
 }
 
-#trivy:ignore:avd-azu-0039
+# Linux password authentication remains an explicit module feature controlled by authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 module "example" {
   source = "cloudeteer/vm/azurerm"
 
diff --git a/r-authentication.tf b/r-authentication.tf
@@ -27,15 +27,18 @@ resource "tls_private_key" "this" {
   rsa_bits  = var.admin_ssh_key_algorithm == "RSA" ? 4096 : null
 }
 
-#trivy:ignore:avd-azu-0017
-#trivy:ignore:avd-azu-0013
+# Generated secrets may intentionally remain non-expiring when rotation is managed externally.
+# Set var.key_vault_secret_expiration_date to enforce an explicit expiry date on generated secrets.
+#trivy:ignore:AVD-AZU-0017
+#trivy:ignore:AVD-AZU-0013
 resource "azurerm_key_vault_secret" "this" {
   for_each = toset([
     for element in split(", ", var.authentication_type) : element if var.store_secret_in_key_vault
   ])
 
-  name         = "${var.name}-${var.admin_username}-${lower(each.key)}"
-  content_type = var.authentication_type
-  key_vault_id = var.key_vault_id
-  value        = coalesce(local.admin_password, local.admin_ssh_private_key)
+  name            = "${var.name}-${var.admin_username}-${lower(each.key)}"
+  content_type    = var.authentication_type
+  expiration_date = var.key_vault_secret_expiration_date
+  key_vault_id    = var.key_vault_id
+  value           = coalesce(local.admin_password, local.admin_ssh_private_key)
 }
diff --git a/r-network.tf b/r-network.tf
@@ -3,7 +3,22 @@ locals {
     azurerm_network_interface.this[*].id,
     (var.network_interface_ids != null ? var.network_interface_ids : [])
   )
+  network_security_group_id = (
+    var.network_security_group_id != null ?
+    var.network_security_group_id :
+    try(one(azurerm_network_security_group.this[*].id), null)
+  )
+
+}
 
+resource "azurerm_network_security_group" "this" {
+
+  count = var.create_network_interface && var.network_security_group_id == null ? 1 : 0
+
+  name                = "nsg-${trimprefix(var.name, "vm-")}"
+  location            = var.location
+  resource_group_name = var.resource_group_name
+  tags                = var.tags
 }
 
 resource "azurerm_network_interface" "this" {
@@ -26,6 +41,13 @@ resource "azurerm_network_interface" "this" {
   }
 }
 
+resource "azurerm_network_interface_security_group_association" "this" {
+  count = var.create_network_interface ? 1 : 0
+
+  network_interface_id      = azurerm_network_interface.this[0].id
+  network_security_group_id = local.network_security_group_id
+}
+
 resource "azurerm_public_ip" "this" {
   count = var.create_public_ip_address ? 1 : 0
 
diff --git a/r-vm.tf b/r-vm.tf
@@ -9,7 +9,11 @@ locals {
   )
 }
 
-# trivy:ignore:avd-azu-0039
+# Module-managed NICs are associated with an NSG in r-network.tf; externally supplied NICs remain consumer-managed.
+#trivy:ignore:AVD-AZU-0068
+# Linux password authentication remains an explicit module feature controlled by var.authentication_type.
+# Prefer SSH-only authentication where organizational policy requires it.
+#trivy:ignore:AVD-AZU-0039
 resource "azurerm_linux_virtual_machine" "this" {
   count = local.is_linux ? 1 : 0
 
@@ -113,6 +117,8 @@ resource "azurerm_linux_virtual_machine" "this" {
 }
 
 resource "azurerm_windows_virtual_machine" "this" {
+  # Module-managed NICs are associated with an NSG in r-network.tf; externally supplied NICs remain consumer-managed.
+  #trivy:ignore:AVD-AZU-0068
   count = local.is_windows ? 1 : 0
 
   name                = var.name
diff --git a/tests/examples/mocks/azurerm_network_interface_security_group_association.tfmock.hcl b/tests/examples/mocks/azurerm_network_interface_security_group_association.tfmock.hcl
@@ -0,0 +1,5 @@
+mock_resource "azurerm_network_interface_security_group_association" {
+  defaults = {
+    id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkInterfaces/NIC-MOCK|/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkSecurityGroups/NSG-MOCK"
+  }
+}
diff --git a/tests/examples/mocks/azurerm_network_security_group.tfmock.hcl b/tests/examples/mocks/azurerm_network_security_group.tfmock.hcl
@@ -0,0 +1,5 @@
+mock_resource "azurerm_network_security_group" {
+  defaults = {
+    id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkSecurityGroups/NSG-MOCK"
+  }
+}
diff --git a/tests/local/input_key_vault_id.tftest.hcl b/tests/local/input_key_vault_id.tftest.hcl
@@ -40,3 +40,31 @@ run "should_add_key_vault_id_as_tag_to_virtual_machine" {
     error_message = "Expected to add key vault id as tag to virtual machine"
   }
 }
+
+run "should_set_key_vault_secret_expiration_date" {
+  command = plan
+
+  variables {
+    authentication_type              = "SSH"
+    image                            = "Ubuntu2204"
+    key_vault_secret_expiration_date = "2030-01-01T00:00:00Z"
+    operating_system                 = "Linux"
+  }
+
+  assert {
+    condition     = one(values(azurerm_key_vault_secret.this)).expiration_date == var.key_vault_secret_expiration_date
+    error_message = "Expected generated Key Vault secrets to use the configured expiration date."
+  }
+}
+
+run "should_fail_with_invalid_key_vault_secret_expiration_date" {
+  command = plan
+
+  variables {
+    key_vault_secret_expiration_date = "not-a-timestamp"
+  }
+
+  expect_failures = [
+    var.key_vault_secret_expiration_date,
+  ]
+}
diff --git a/tests/local/input_network.tftest.hcl b/tests/local/input_network.tftest.hcl
@@ -19,6 +19,16 @@ run "should_use_subnet_id" {
     condition     = azurerm_network_interface.this[0].ip_configuration[0].subnet_id == var.subnet_id
     error_message = "Expected to create network interface and use subnet id vom variable input"
   }
+
+  assert {
+    condition     = length(azurerm_network_security_group.this) == 1
+    error_message = "Expected the module to create a default network security group when no network_security_group_id is provided."
+  }
+
+  assert {
+    condition     = length(azurerm_network_interface_security_group_association.this) == 1
+    error_message = "Expected the created network interface to have a network security group association."
+  }
 }
 
 run "should_fail_with_no_subnet_id" {
@@ -52,6 +62,25 @@ run "should_use_network_interface_ids_from_input_only" {
   }
 }
 
+run "should_use_existing_network_security_group_for_created_network_interface" {
+  command = plan
+
+  variables {
+    network_security_group_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/networkSecurityGroups/nsg-existing"
+    subnet_id                 = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/snet"
+  }
+
+  assert {
+    condition     = length(azurerm_network_security_group.this) == 0
+    error_message = "Expected no network security group to be created when network_security_group_id is provided."
+  }
+
+  assert {
+    condition     = length(azurerm_network_interface_security_group_association.this) == 1
+    error_message = "Expected the created network interface to have a network security group association when network_security_group_id is provided."
+  }
+}
+
 
 run "should_assert_three_network_interfaces" {
   command = plan
diff --git a/tests/local/mocks/azurerm_network_interface_security_group_association.tfmock.hcl b/tests/local/mocks/azurerm_network_interface_security_group_association.tfmock.hcl
@@ -0,0 +1,5 @@
+mock_resource "azurerm_network_interface_security_group_association" {
+  defaults = {
+    id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkInterfaces/NIC-MOCK|/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkSecurityGroups/NSG-MOCK"
+  }
+}
diff --git a/tests/local/mocks/azurerm_network_security_group.tfmock.hcl b/tests/local/mocks/azurerm_network_security_group.tfmock.hcl
@@ -0,0 +1,5 @@
+mock_resource "azurerm_network_security_group" {
+  defaults = {
+    id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RG-MOCK/providers/Microsoft.Network/networkSecurityGroups/NSG-MOCK"
+  }
+}
diff --git a/variables.tf b/variables.tf
@@ -461,6 +461,28 @@ variable "key_vault_id" {
   }
 }
 
+variable "key_vault_secret_expiration_date" {
+  description = <<-EOT
+  The RFC3339 timestamp to assign as `expiration_date` on generated Azure Key Vault secrets.
+
+  - Applies only when `store_secret_in_key_vault` is `true`.
+  - Leave as `null` to keep generated secrets without an explicit expiry date.
+  EOT
+
+  default = null
+  type    = string
+
+  validation {
+    condition     = var.key_vault_secret_expiration_date == null ? true : var.store_secret_in_key_vault
+    error_message = "key_vault_secret_expiration_date can only be set when store_secret_in_key_vault is true."
+  }
+
+  validation {
+    condition     = var.key_vault_secret_expiration_date == null ? true : can(formatdate("", var.key_vault_secret_expiration_date))
+    error_message = "key_vault_secret_expiration_date must be a valid RFC3339 timestamp, for example 2030-01-01T00:00:00Z."
+  }
+}
+
 variable "license_type" {
   description = <<-EOT
   Specifies the license type to be used for this Virtual Machine.
@@ -505,6 +527,18 @@ variable "network_interface_ids" {
   type        = list(string)
 }
 
+variable "network_security_group_id" {
+  description = <<-EOT
+  The resource ID of an existing Azure Network Security Group to associate with the network interface created by this module.
+
+  - Applies only when `create_network_interface` is `true`.
+  - If omitted and `create_network_interface` is `true`, this module creates and associates a default Network Security Group.
+  EOT
+
+  default = null
+  type    = string
+}
+
 variable "operating_system" {
   default     = null
   description = "The virtual machine's operating system. Valid values are `Linux` or `Windows`. The default is `null`, which determines the operating system to use based on the virtual machine image offering."

Original file line number	Diff line number	Diff line change
`@@ -86,7 +86,9 @@ data "azurerm_key_vault_secret" "domain_join_user" {`
`86`	`86`	`}`
`87`	`87`
`88`	`88`
`89`		`-#trivy:ignore:avd-azu-0039`
	`89`	`+# Linux password authentication remains an explicit module feature controlled by authentication_type.`
	`90`	`+# Prefer SSH-only authentication where organizational policy requires it.`
	`91`	`+#trivy:ignore:AVD-AZU-0039`
`90`	`92`	`module "example" {`
`91`	`93`	`source = "cloudeteer/vm/azurerm"`
`92`	`94`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,9 @@ variable "location" {`
`27`	`27`	`type = string`
`28`	`28`	`}`
`29`	`29`
`30`		`-#trivy:ignore:avd-azu-0039`
	`30`	`+# Linux password authentication remains an explicit module feature controlled by authentication_type.`
	`31`	`+# Prefer SSH-only authentication where organizational policy requires it.`
	`32`	`+#trivy:ignore:AVD-AZU-0039`
`31`	`33`	`module "example" {`
`32`	`34`	`source = "cloudeteer/vm/azurerm"`
`33`	`35`
Original file line number	Diff line number	Diff line change
`@@ -66,7 +66,9 @@ resource "azurerm_key_vault" "example" {`
`66`	`66`	`}`
`67`	`67`	`}`
`68`	`68`
`69`		`-#trivy:ignore:avd-azu-0039`
	`69`	`+# Linux password authentication remains an explicit module feature controlled by authentication_type.`
	`70`	`+# Prefer SSH-only authentication where organizational policy requires it.`
	`71`	`+#trivy:ignore:AVD-AZU-0039`
`70`	`72`	`module "example" {`
`71`	`73`	`source = "cloudeteer/vm/azurerm"`
`72`	`74`
Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,11 @@ locals {`
`9`	`9`	`)`
`10`	`10`	`}`
`11`	`11`
`12`		`-# trivy:ignore:avd-azu-0039`
	`12`	`+# Module-managed NICs are associated with an NSG in r-network.tf; externally supplied NICs remain consumer-managed.`
	`13`	`+#trivy:ignore:AVD-AZU-0068`
	`14`	`+# Linux password authentication remains an explicit module feature controlled by var.authentication_type.`
	`15`	`+# Prefer SSH-only authentication where organizational policy requires it.`
	`16`	`+#trivy:ignore:AVD-AZU-0039`
`13`	`17`	`resource "azurerm_linux_virtual_machine" "this" {`
`14`	`18`	`count = local.is_linux ? 1 : 0`
`15`	`19`
`@@ -113,6 +117,8 @@ resource "azurerm_linux_virtual_machine" "this" {`
`113`	`117`	`}`
`114`	`118`
`115`	`119`	`resource "azurerm_windows_virtual_machine" "this" {`
	`120`	`+ # Module-managed NICs are associated with an NSG in r-network.tf; externally supplied NICs remain consumer-managed.`
	`121`	`+ #trivy:ignore:AVD-AZU-0068`
`116`	`122`	`count = local.is_windows ? 1 : 0`
`117`	`123`
`118`	`124`	`name = var.name`