Skip to content

Commit 96afa1f

Browse files
xiaxyixiaxyi
authored
Add example for azure function app using key vault reference (microsoft#114)
add examples for function app using key vault reference
1 parent e32966e commit 96afa1f

File tree

6 files changed

+268
-0
lines changed

6 files changed

+268
-0
lines changed

‎quickstart/201-function-app-key-vault-ref/.terraform-docs.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
formatter: "markdown table"
2+
3+
content: |-
4+
{{ .Resources }}
5+
{{ .Inputs }}
6+
{{ .Providers }}
7+
{{ .Requirements }}
8+
9+
output:
10+
file: readme.html.markdown
11+
mode: inject

‎quickstart/201-function-app-key-vault-ref/.tflint.hcl‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
/*
2+
THIS FILE IS GENERATED BY TFMOD-SCAFFOLD, PLEASE DO NOT MODIFY IT.
3+
IF YOU WANT TO USE A CUSTOMIZED CONFIGURATION, PLEASE CREATE YOUR OWN AND
4+
SET THIS FILE'S PATH TO $TFLINT_CONFIG ENVVIRONMENT VARIABLE.
5+
*/
6+
7+
plugin "azurerm" {
8+
enabled = true
9+
version = "0.18.0"
10+
source = "github.com/terraform-linters/tflint-ruleset-azurerm"
11+
}
12+
13+
rule "terraform_comment_syntax" {
14+
enabled = true
15+
}
16+
17+
rule "terraform_deprecated_index" {
18+
enabled = true
19+
}
20+
21+
rule "terraform_deprecated_interpolation" {
22+
enabled = true
23+
}
24+
25+
rule "terraform_documented_outputs" {
26+
enabled = true
27+
}
28+
29+
rule "terraform_documented_variables" {
30+
enabled = true
31+
}
32+
33+
rule "terraform_module_pinned_source" {
34+
enabled = true
35+
}
36+
37+
rule "terraform_module_version" {
38+
enabled = true
39+
}
40+
41+
rule "terraform_naming_convention" {
42+
enabled = true
43+
}
44+
45+
rule "terraform_required_providers" {
46+
enabled = true
47+
}
48+
49+
rule "terraform_required_version" {
50+
enabled = true
51+
}
52+
53+
rule "terraform_standard_module_structure" {
54+
enabled = false
55+
}
56+
57+
rule "terraform_typed_variables" {
58+
enabled = true
59+
}
60+
61+
rule "terraform_unused_declarations" {
62+
enabled = true
63+
}
64+
65+
rule "terraform_unused_required_providers" {
66+
enabled = true
67+
}
68+
69+
rule "terraform_workspace_remote" {
70+
enabled = true
71+
}

‎quickstart/201-function-app-key-vault-ref/main.tf‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
resource "azurerm_resource_group" "default" {
4+
name = "${var.name_prefix}-rg"
5+
location = var.location
6+
}
7+
8+
resource "azurerm_user_assigned_identity" "default" {
9+
name = "${var.name_prefix}-uai"
10+
resource_group_name = azurerm_resource_group.default.name
11+
location = azurerm_resource_group.default.location
12+
}
13+
14+
resource "azurerm_storage_account" "default" {
15+
name = "${var.name_prefix}sa"
16+
resource_group_name = azurerm_resource_group.default.name
17+
location = azurerm_resource_group.default.location
18+
account_tier = "Standard"
19+
account_replication_type = "LRS"
20+
}
21+
22+
resource "azurerm_service_plan" "default" {
23+
name = "${var.name_prefix}-sp"
24+
location = azurerm_resource_group.default.location
25+
resource_group_name = azurerm_resource_group.default.name
26+
os_type = "Windows"
27+
sku_name = "Y1"
28+
}
29+
30+
31+
resource "azurerm_key_vault" "default" {
32+
name = "${var.name_prefix}-kv"
33+
location = azurerm_resource_group.default.location
34+
resource_group_name = azurerm_resource_group.default.name
35+
tenant_id = data.azurerm_client_config.current.tenant_id
36+
sku_name = "standard"
37+
soft_delete_retention_days = 7
38+
39+
access_policy {
40+
tenant_id = data.azurerm_client_config.current.tenant_id
41+
object_id = data.azurerm_client_config.current.object_id
42+
43+
key_permissions = [
44+
"Get",
45+
]
46+
47+
secret_permissions = [
48+
"Get",
49+
"Delete",
50+
"List",
51+
"Purge",
52+
"Recover",
53+
"Set",
54+
]
55+
}
56+
57+
access_policy {
58+
tenant_id = data.azurerm_client_config.current.tenant_id
59+
object_id = azurerm_user_assigned_identity.default.principal_id
60+
61+
secret_permissions = [
62+
"Get",
63+
"List",
64+
]
65+
}
66+
67+
tags = {
68+
environment = "tfTest"
69+
}
70+
}
71+
72+
resource "azurerm_key_vault_secret" "default" {
73+
name = "${var.name_prefix}-kvs"
74+
value = azurerm_storage_account.default.primary_connection_string
75+
key_vault_id = azurerm_key_vault.default.id
76+
}
77+
78+
/* when using key vault reference in functions app, please follow below instructions:
79+
1. when using event-driven scaling plans such as consumption and premium plan, WEBSITE_CONTENTSHARE key should be set in app_setting block. You don't need to explicitly specify it as Azure will generate a unique file share for you, unless:
80+
1) You are using a secure storage account in a virtual network. In this case, you must set the WEBSITE_CONTENTSHARE value to a predefined share and set a unique share name for the main function app and the app for each deployment slot.
81+
2) You can using key vault reference for setting WEBSITE_CONTENTAZUREFILECONNECTIONSTRING. This setting has additional validation check to ensure that the app can be properly started, check will fail as the secret itself cannot be resolved while processing the incoming request.
82+
3) Please don't make WEBSITE_CONTENTSHARE a slot setting.
83+
To avoid the failure of the azure file check mentioned above, you can skip the validation by setting WEBSITE_SKIP_CONTENTSHARE_VALIDATION to "1". This will bypass all checks, and the content share will not be created for you. You should ensure it is created in advance.
84+
85+
2. please make sure to set storage_key_vault_secret_id property to configure the app to use this identity for Key Vault reference operations.
86+
*/
87+
resource "azurerm_windows_function_app" "default" {
88+
name = "${var.name_prefix}-wfa"
89+
resource_group_name = azurerm_resource_group.default.name
90+
location = azurerm_resource_group.default.location
91+
92+
service_plan_id = azurerm_service_plan.default.id
93+
94+
storage_key_vault_secret_id = azurerm_key_vault_secret.default.id
95+
96+
key_vault_reference_identity_id = azurerm_user_assigned_identity.default.id
97+
98+
app_settings = {
99+
WEBSITE_SKIP_CONTENTSHARE_VALIDATION = 1
100+
}
101+
102+
identity {
103+
type = "UserAssigned"
104+
identity_ids = [azurerm_user_assigned_identity.default.id]
105+
}
106+
107+
site_config {
108+
application_stack {
109+
node_version = "~14"
110+
}
111+
}
112+
}

‎quickstart/201-function-app-key-vault-ref/providers.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
terraform {
2+
required_version = ">=1.0"
3+
4+
required_providers {
5+
azurerm = {
6+
source = "hashicorp/azurerm"
7+
version = "~>3.8"
8+
}
9+
}
10+
}
11+
provider "azurerm" {
12+
features {
13+
key_vault {
14+
purge_soft_delete_on_destroy = true
15+
recover_soft_deleted_key_vaults = true
16+
}
17+
}
18+
}

‎quickstart/201-function-app-key-vault-ref/readme.html.markdown‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Azure Windows/ Linux Function App using key vault reference
2+
3+
This template deploys an Azure Function App running using key vault reference
4+
5+
<!-- Run the following commands on your Windows machine to update document -->
6+
<!-- docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest terraform-docs markdown table --output-file readme.html.markdown --output-mode inject ./ -->
7+
<!-- docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest markdown-table-formatter readme.html.markdown -->
8+
<!-- Run the following command to lint Terraform code with tflint -->
9+
<!-- docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest tflint --config=.tflint.hcl -->
10+
<!-- Run the following command to lint Terraform code with Checkov -->
11+
<!-- docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest checkov --skip-framework dockerfile --quiet -d ./ -->
12+
<!-- -->
13+
<!-- BEGIN_TF_DOCS -->
14+
## Resources
15+
16+
| Name | Type |
17+
|--------------------------------------------------------------------------------------------------------------------------------------------------|-------------|
18+
| [azurerm_key_vault.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) | resource |
19+
| [azurerm_key_vault_secret.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
20+
| [azurerm_resource_group.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource |
21+
| [azurerm_service_plan.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/service_plan) | resource |
22+
| [azurerm_storage_account.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account) | resource |
23+
| [azurerm_user_assigned_identity.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity) | resource |
24+
| [azurerm_windows_function_app.default](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/windows_function_app) | resource |
25+
| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |
26+
## Inputs
27+
28+
| Name | Description | Type | Default | Required |
29+
|-----------------------------------------------------------------------|---------------------------------------|----------|---------------|:--------:|
30+
| <a name="input_location"></a> [location](#input\_location) | Location to deploy the resource group | `string` | `"West US 2"` | no |
31+
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | Prefix of the resource name | `string` | n/a | yes |
32+
## Providers
33+
34+
| Name | Version |
35+
|---------------------------------------------------------------|---------|
36+
| <a name="provider_azurerm"></a> [azurerm](#provider\_azurerm) | ~>3.8 |
37+
## Requirements
38+
39+
| Name | Version |
40+
|---------------------------------------------------------------------------|---------|
41+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.0 |
42+
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~>3.8 |
43+
<!-- END_TF_DOCS -->
44+
## Example
45+
46+
To see how to run this example, see [Create an Azure Function App using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-azure-windows-linux-function-app-using-key-vault-reference).

‎quickstart/201-function-app-key-vault-ref/variables.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
variable "name_prefix" {
2+
type = string
3+
description = "Prefix of the resource name"
4+
}
5+
6+
variable "location" {
7+
type = string
8+
description = "Location to deploy the resource group"
9+
default = "West US 2"
10+
}

0 commit comments

Comments
 (0)