Add Key Vault ID as a tag to virtual machines and enhance variable descriptions (#85)

Signed-off-by: Andre Licht <al@cloudeteer.de>

Author: lixhunter

README.md

@@ -599,7 +599,10 @@ Default: `null`
 
 ### <a name="input_key_vault_id"></a> [key\_vault\_id](#input\_key\_vault\_id)
 
-Description: Key Vault ID to store the generated admin password or admin SSH private key. Required when admin\_password or admin\_ssh\_public\_key is not set. Must not be set if either admin\_password or admin\_ssh\_public\_key is set.
+Description: The resource ID of the Azure Key Vault where the generated admin password or SSH private key should be stored as a secret.
+
+- Required when `store_secret_in_key_vault` is `true`.
+- Must be `null` when `store_secret_in_key_vault` is `false`.
 
 Type: `string`
 
@@ -810,7 +813,10 @@ Default: `null`
 
 ### <a name="input_store_secret_in_key_vault"></a> [store\_secret\_in\_key\_vault](#input\_store\_secret\_in\_key\_vault)
 
-Description: If set to `true`, the secrets generated by this module will be stored in the Key Vault specified by `key_vault_id`.
+Description: Whether to store generated secrets (admin password or SSH private key) in an Azure Key Vault.
+
+- If `true`, you must provide `key_vault_id`.
+- If `false`, `key_vault_id` must be unset and no secrets will be stored.
 
 Type: `bool`
 

r-vm.tf

@@ -2,6 +2,11 @@ locals {
   virtual_machine = (local.is_linux ? azurerm_linux_virtual_machine.this[0] :
     (local.is_windows ? azurerm_windows_virtual_machine.this[0] : null)
   )
+  tags_virtual_machine = merge(
+    var.tags,
+    var.tags_virtual_machine,
+    (var.key_vault_id != null ? { key_vault_id = var.key_vault_id } : {})
+  )
 }
 
 # trivy:ignore:avd-azu-0039
@@ -11,7 +16,7 @@ resource "azurerm_linux_virtual_machine" "this" {
   name                = var.name
   location            = var.location
   resource_group_name = var.resource_group_name
-  tags                = merge(var.tags, var.tags_virtual_machine)
+  tags                = local.tags_virtual_machine
 
   admin_password                                         = local.admin_password
   admin_username                                         = var.admin_username
@@ -113,7 +118,7 @@ resource "azurerm_windows_virtual_machine" "this" {
   name                = var.name
   location            = var.location
   resource_group_name = var.resource_group_name
-  tags                = merge(var.tags, var.tags_virtual_machine)
+  tags                = local.tags_virtual_machine
 
   admin_password                                         = local.admin_password
   admin_username                                         = var.admin_username

tests/local/input_authentication.tftest.hcl

@@ -39,6 +39,8 @@ run "should_input_admin_password_output_same_value_on_windows" {
     authentication_type       = "Password"
     image                     = "Win2022Datacenter"
     store_secret_in_key_vault = false
+    # Unset default, set in variables.auto.tfvars
+    key_vault_id = null
   }
 
   assert {
@@ -106,6 +108,8 @@ run "should_input_admin_password_output_same_value_on_linux" {
     image                     = "Ubuntu2204"
     operating_system          = "Linux"
     store_secret_in_key_vault = false
+    # Unset default, set in variables.auto.tfvars
+    key_vault_id = null
   }
 
   assert {
@@ -153,6 +157,8 @@ run "should_input_admin_ssh_public_key_output_same_value_on_linux" {
     image                     = "Ubuntu2204"
     operating_system          = "Linux"
     store_secret_in_key_vault = false
+    # Unset default, set in variables.auto.tfvars
+    key_vault_id = null
   }
 
   assert {

tests/local/input_key_vault_id.tftest.hcl

@@ -0,0 +1,42 @@
+mock_provider "azapi" { source = "tests/local/mocks" }
+mock_provider "azurerm" { source = "tests/local/mocks" }
+mock_provider "random" { source = "tests/local/mocks" }
+mock_provider "tls" { source = "tests/local/mocks" }
+
+run "should_not_add_key_vault_id_as_tag_to_virtual_machine" {
+  command = plan
+
+  variables {
+    image                     = "Ubuntu2204"
+    operating_system          = "Linux"
+    store_secret_in_key_vault = false
+    admin_password            = bcrypt(uuid())
+    tags = {
+      "var_tags" = "var_tag"
+    }
+    tags_virtual_machine = {
+      "var_vm_tags" = "var_vm_tag"
+    }
+    key_vault_id = null
+  }
+
+  assert {
+    condition     = contains(keys(azurerm_linux_virtual_machine.this[0].tags), "key_vault_id") == false
+    error_message = "Tag key_vault_id should not exist on the virtual machine"
+  }
+}
+
+run "should_add_key_vault_id_as_tag_to_virtual_machine" {
+  command = plan
+
+  variables {
+    image            = "Ubuntu2204"
+    operating_system = "Linux"
+    key_vault_id     = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.KeyVault/vaults/localvault"
+  }
+
+  assert {
+    condition     = azurerm_linux_virtual_machine.this[0].tags["key_vault_id"] == "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.KeyVault/vaults/localvault"
+    error_message = "Expected to add key vault id as tag to virtual machine"
+  }
+}

variables.tf

@@ -454,18 +454,20 @@ variable "image" {
 }
 
 variable "key_vault_id" {
-  description = "Key Vault ID to store the generated admin password or admin SSH private key. Required when admin_password or admin_ssh_public_key is not set. Must not be set if either admin_password or admin_ssh_public_key is set."
-  default     = null
-  type        = string
+  description = <<-EOT
+  The resource ID of the Azure Key Vault where the generated admin password or SSH private key should be stored as a secret.
+
+  - Required when `store_secret_in_key_vault` is `true`.
+  - Must be `null` when `store_secret_in_key_vault` is `false`.
+  EOT
 
-  # validation {
-  #   condition = var.key_vault_id == null ? (
-  #     (var.authentication_type == "Password" && var.admin_password != null) || (var.authentication_type == "SSH" && var.admin_ssh_public_key != null)
-  #     ) : (
-  #     (var.authentication_type == "Password" && var.admin_password == null) || (var.authentication_type == "SSH" && var.admin_ssh_public_key == null)
-  #   )
-  #   error_message = "Invalid combination of key_vault_id, admin_password, and admin_ssh_public_key. If key_vault_id is null, admin_password or admin_ssh_public_key must be non-null. If key_vault_id is not null, admin_password and admin_ssh_public_key must be null."
-  # }
+  default = null
+  type    = string
+
+  validation {
+    condition     = var.store_secret_in_key_vault ? var.key_vault_id != null : var.key_vault_id == null
+    error_message = "When store_secret_in_key_vault is true, key_vault_id must be set. When false, it must be null."
+  }
 }
 
 variable "license_type" {
@@ -691,9 +693,15 @@ variable "source_image_id" {
 }
 
 variable "store_secret_in_key_vault" {
-  description = "If set to `true`, the secrets generated by this module will be stored in the Key Vault specified by `key_vault_id`."
-  type        = bool
-  default     = true
+  description = <<-EOT
+  Whether to store generated secrets (admin password or SSH private key) in an Azure Key Vault.
+
+  - If `true`, you must provide `key_vault_id`.
+  - If `false`, `key_vault_id` must be unset and no secrets will be stored.
+  EOT
+
+  type    = bool
+  default = true
 }
 
 variable "subnet_id" {