Manage Azure Key Vault Secrets with Terraform and JSON | Step-by-Step Guide

Managing secrets securely is essential for any modern application. In this post, we demonstrate how to streamline the creation of Azure Key Vault secrets using Terraform and JSON. This approach ensures scalability, automation, and security compliance.

"Handle Azure Key Vault secrets using Terraform."

Prerequisites: 

1. Install and configure the Azure CLI. 
2. Authenticate user have access to create secrets. 
3. Ensure that your Azure Key Vault exists or include its creation in your Terraform configuration. 

JSON File Example: Save your JSON file as secrets.json:

{
    "secret1": "mypassword123",
    "secret2": "abcdefg12345",
    "secret3": "storagekey12345"
}

Steps to Deploy: 

Below is a Terraform configuration that Reads the JSON file. Iterates through the key-value pairs. Creates secrets in Azure Key Vault.

main.tf

data "template_file" "secrets" {
  template = file("secrets.json")
}

data  "azurerm_key_vault" "existing_vault" {
  resource_group_name = "rg-ci-name"
  name                = "kv-ci-name"
}

locals {
  secrets = jsondecode(data.template_file.secrets.rendered)
}

resource "azurerm_key_vault_secret" "secrets" {
  for_each            = local.secrets
  name                = each.key
  value               = each.value
  key_vault_id        = data.azurerm_key_vault.existing_vault.id
}

providers.tf

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "4.14.0"
    }
  }
}

provider "azurerm" {
  features {}
  skip_provider_registration = "true"
  subscription_id            = "-----Your-SubID-----"
}

Explanation: 

1. JSON Loading: The data "template_file" block reads the secrets.json file. 
2. Decoding JSON: The jsondecode function parses the JSON into a map. 
3. Dynamic Resource Creation: The for_each statement iterates through the key-value pairs and creates an Azure Key Vault secret for each. 

Notes:

Make sure to replace placeholders like myKeyVault and myResourceGroup with the actual names and details of your Azure resources. Also, ensure that the secrets.json file is in the same directory as your Terraform configuration, or update the file path accordingly in your script to avoid errors.

Conclusion:

Congratulations! You’ve just learned how to automate the creation of Azure Key Vault secrets using a simple and efficient Terraform configuration with a JSON file. This approach makes managing secrets easy, scalable, and secure.

We’d love to hear from you! If you have any suggestions, questions, or improvements, feel free to leave a comment below. Let’s keep the conversation going! 😊