CMK Encryption support for resources in templates (#4195)

* change cmk name to include tre-id + add dependency to one of the stg accounts * add cmk for ACR and service bus * add null default for acr_sku * bump core version to 0.11.8 * set 'Enable support for customer-managed keys' for tables and queues in storage accounts (core/mgmt only) * add key type encryption to state store * add support for customer-managed key (CMK) encryption in templates * fix terraform issues found by linter * raise minor instead of major version * fix terraform issues found by linter * fix terraform issues found by linter * fix: update identity_client_id reference in azureml * remove the 'vmss' from disks encryption set names * move all data resources to a data.tf file
microsoft · Dec 23, 2024 · 8baad00 · 8baad00
1 parent 6632ed0
commit 8baad00
Show file tree

Hide file tree

Showing 80 changed files with 767 additions and 87 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -26,6 +26,7 @@ ENHANCEMENTS:
 * Add ability to download VSCode Extensions ([[#4187](https://github.com/microsoft/AzureTRE/issues/4187)])
 * Update Windows VM Images ([#4198](https://github.com/microsoft/AzureTRE/pull/4198))
 * Enhance DPI of Linux display ([[#4200](https://github.com/microsoft/AzureTRE/issues/4200)])
+* Add support for customer-managed keys encryption in templates ([#4145](https://github.com/microsoft/AzureTRE/issues/4145))
 
 BUG FIXES:
 * Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))

diff --git a/core/terraform/cmk_encryption.tf b/core/terraform/cmk_encryption.tf
@@ -4,7 +4,7 @@ resource "azurerm_user_assigned_identity" "encryption" {
   location            = azurerm_resource_group.core.location
   tags                = local.tre_core_tags
 
-  name = "id-encryption-${var.tre_id}"
+  name = local.encryption_identity_name
 
   lifecycle { ignore_changes = [tags] }
 }

diff --git a/core/terraform/locals.tf b/core/terraform/locals.tf
@@ -44,5 +44,6 @@ locals {
   # The key store for encryption keys could either be external or created by terraform
   key_store_id = var.enable_cmk_encryption ? (var.external_key_store_id != null ? var.external_key_store_id : data.azurerm_key_vault.encryption_kv[0].id) : ""
 
-  cmk_name = "tre-encryption-${var.tre_id}"
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }
diff --git a/core/version.txt b/core/version.txt
@@ -1 +1 @@
-__version__ = "0.11.9"
+__version__ = "0.11.10"
diff --git a/docs/tre-admins/customer-managed-keys.md b/docs/tre-admins/customer-managed-keys.md
@@ -2,11 +2,6 @@
 
 You can enable customer-managed keys (CMK) for supporting resources in Azure TRE.
 
-!!! warning
-    Currently Azure TRE only supports CMK encryption for resources in the TRE core and Base Workspace.
-    CMK encryption is not supported for the rest of the resources such as those deployed by a TRE workspace.
-
-
 !!! caution
     Currently, it is not possible to redeploy TRE with CMK enabled if it has previously been deployed without it. This is due to limitations of resources such as Azure Container Registry (ACR) that only allow enabling the CMK encryption at the time of resource creation.
 

diff --git a/templates/shared_services/admin-vm/parameters.json b/templates/shared_services/admin-vm/parameters.json
@@ -45,6 +45,18 @@
       "source": {
         "env": "ARM_ENVIRONMENT"
       }
+    },
+    {
+      "name": "enable_cmk_encryption",
+      "source": {
+        "env": "ENABLE_CMK_ENCRYPTION"
+      }
+    },
+    {
+      "name": "key_store_id",
+      "source": {
+        "env": "KEY_STORE_ID"
+      }
     }
   ]
 }
diff --git a/templates/shared_services/admin-vm/porter.yaml b/templates/shared_services/admin-vm/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-admin-vm
-version: 0.4.8
+version: 0.5.0
 description: "An admin vm shared service"
 dockerfile: Dockerfile.tmpl
 registry: azuretre
@@ -44,6 +44,12 @@ parameters:
     env: ADMIN_JUMPBOX_VM_SKU
     type: string
     default: Standard_B2s
+  - name: enable_cmk_encryption
+    type: boolean
+    default: false
+  - name: key_store_id
+    type: string
+    default: ""
 
 mixins:
   - terraform:
@@ -56,6 +62,8 @@ install:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -71,6 +79,8 @@ upgrade:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -86,6 +96,8 @@ uninstall:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

diff --git a/templates/shared_services/admin-vm/terraform/admin-jumpbox.tf b/templates/shared_services/admin-vm/terraform/admin-jumpbox.tf
@@ -45,14 +45,30 @@ resource "azurerm_windows_virtual_machine" "jumpbox" {
   }
 
   os_disk {
-    name                 = "vm-dsk-${var.tre_id}"
-    caching              = "ReadWrite"
-    storage_account_type = "Standard_LRS"
+    name                   = "vm-dsk-${var.tre_id}"
+    caching                = "ReadWrite"
+    storage_account_type   = "Standard_LRS"
+    disk_encryption_set_id = var.enable_cmk_encryption ? azurerm_disk_encryption_set.jumpbox_disk_encryption[0].id : null
   }
 
   lifecycle { ignore_changes = [tags] }
 }
 
+resource "azurerm_disk_encryption_set" "jumpbox_disk_encryption" {
+  count                     = var.enable_cmk_encryption ? 1 : 0
+  name                      = "disk-encryption-jumpbox-${var.tre_id}-${var.tre_resource_id}"
+  location                  = data.azurerm_resource_group.rg.location
+  resource_group_name       = data.azurerm_resource_group.rg.name
+  key_vault_key_id          = data.azurerm_key_vault_key.tre_encryption_key[0].versionless_id
+  encryption_type           = "EncryptionAtRestWithPlatformAndCustomerKeys"
+  auto_key_rotation_enabled = true
+
+  identity {
+    type         = "UserAssigned"
+    identity_ids = [data.azurerm_user_assigned_identity.tre_encryption_identity[0].id]
+  }
+}
+
 resource "azurerm_key_vault_secret" "jumpbox_credentials" {
   name         = "${azurerm_windows_virtual_machine.jumpbox.name}-jumpbox-password"
   value        = random_password.password.result

diff --git a/templates/shared_services/admin-vm/terraform/data.tf b/templates/shared_services/admin-vm/terraform/data.tf
@@ -11,3 +11,15 @@ data "azurerm_key_vault" "keyvault" {
 data "azurerm_resource_group" "rg" {
   name = local.core_resource_group_name
 }
+
+data "azurerm_key_vault_key" "tre_encryption_key" {
+  count        = var.enable_cmk_encryption ? 1 : 0
+  name         = local.cmk_name
+  key_vault_id = var.key_store_id
+}
+
+data "azurerm_user_assigned_identity" "tre_encryption_identity" {
+  count               = var.enable_cmk_encryption ? 1 : 0
+  name                = local.encryption_identity_name
+  resource_group_name = local.core_resource_group_name
+}
diff --git a/templates/shared_services/admin-vm/terraform/locals.tf b/templates/shared_services/admin-vm/terraform/locals.tf
@@ -6,4 +6,6 @@ locals {
     tre_id                = var.tre_id
     tre_shared_service_id = var.tre_resource_id
   }
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }
diff --git a/templates/shared_services/admin-vm/terraform/variables.tf b/templates/shared_services/admin-vm/terraform/variables.tf
@@ -11,3 +11,12 @@ variable "tre_resource_id" {
 variable "admin_jumpbox_vm_sku" {
   type = string
 }
+
+variable "enable_cmk_encryption" {
+  type    = bool
+  default = false
+}
+
+variable "key_store_id" {
+  type = string
+}
diff --git a/templates/shared_services/certs/parameters.json b/templates/shared_services/certs/parameters.json
@@ -57,6 +57,18 @@
       "source": {
         "env": "ARM_ENVIRONMENT"
       }
+    },
+    {
+      "name": "enable_cmk_encryption",
+      "source": {
+        "env": "ENABLE_CMK_ENCRYPTION"
+      }
+    },
+    {
+      "name": "key_store_id",
+      "source": {
+        "env": "KEY_STORE_ID"
+      }
     }
   ]
 }
diff --git a/templates/shared_services/certs/porter.yaml b/templates/shared_services/certs/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-certs
-version: 0.6.1
+version: 0.7.0
 description: "An Azure TRE shared service to generate certificates for a specified internal domain using Letsencrypt"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -51,6 +51,12 @@ parameters:
   - name: id
     type: string
     description: "Resource ID"
+  - name: enable_cmk_encryption
+    type: boolean
+    default: false
+  - name: key_store_id
+    type: string
+    default: ""
 
 mixins:
   - exec
@@ -67,6 +73,8 @@ install:
         domain_prefix: ${ bundle.parameters.domain_prefix }
         cert_name: ${ bundle.parameters.cert_name }
         tre_resource_id: ${ bundle.parameters.id }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -116,7 +124,6 @@ install:
         resource-group: ${ bundle.outputs.resource_group_name }
         name: ${ bundle.outputs.application_gateway_name }
 
-
 upgrade:
   - exec:
       description: "Upgrade shared service"
@@ -132,6 +139,8 @@ uninstall:
         domain_prefix: ${ bundle.parameters.domain_prefix }
         cert_name: ${ bundle.parameters.cert_name }
         tre_resource_id: ${ bundle.parameters.id }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

diff --git a/templates/shared_services/certs/terraform/data.tf b/templates/shared_services/certs/terraform/data.tf
@@ -1,5 +1,3 @@
-data "azurerm_client_config" "current" {}
-
 data "azurerm_resource_group" "rg" {
   name = "rg-${var.tre_id}"
 }
@@ -19,3 +17,9 @@ data "azurerm_user_assigned_identity" "resource_processor_vmss_id" {
   name                = "id-vmss-${var.tre_id}"
   resource_group_name = "rg-${var.tre_id}"
 }
+
+data "azurerm_user_assigned_identity" "tre_encryption_identity" {
+  count               = var.enable_cmk_encryption ? 1 : 0
+  name                = local.encryption_identity_name
+  resource_group_name = data.azurerm_resource_group.rg.name
+}
diff --git a/templates/shared_services/certs/terraform/locals.tf b/templates/shared_services/certs/terraform/locals.tf
@@ -23,4 +23,7 @@ locals {
     tre_id                = var.tre_id
     tre_shared_service_id = var.tre_resource_id
   }
+
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }
diff --git a/templates/shared_services/certs/terraform/staticweb.tf b/templates/shared_services/certs/terraform/staticweb.tf
@@ -6,6 +6,8 @@ resource "azurerm_storage_account" "staticweb" {
   account_kind                     = "StorageV2"
   account_tier                     = "Standard"
   account_replication_type         = "LRS"
+  table_encryption_key_type        = var.enable_cmk_encryption ? "Account" : "Service"
+  queue_encryption_key_type        = var.enable_cmk_encryption ? "Account" : "Service"
   enable_https_traffic_only        = true
   allow_nested_items_to_be_public  = false
   cross_tenant_replication_enabled = false
@@ -19,9 +21,25 @@ resource "azurerm_storage_account" "staticweb" {
     error_404_document = "404.html"
   }
 
+  dynamic "identity" {
+    for_each = var.enable_cmk_encryption ? [1] : []
+    content {
+      type         = "UserAssigned"
+      identity_ids = [data.azurerm_user_assigned_identity.tre_encryption_identity[0].id]
+    }
+  }
+
   lifecycle { ignore_changes = [infrastructure_encryption_enabled, tags] }
 }
 
+resource "azurerm_storage_account_customer_managed_key" "staticweb_stg_encryption" {
+  count                     = var.enable_cmk_encryption ? 1 : 0
+  storage_account_id        = azurerm_storage_account.staticweb.id
+  key_vault_id              = var.key_store_id
+  key_name                  = local.cmk_name
+  user_assigned_identity_id = data.azurerm_user_assigned_identity.tre_encryption_identity[0].id
+}
+
 resource "azurerm_role_assignment" "stgwriter" {
   scope                = azurerm_storage_account.staticweb.id
   role_definition_name = "Storage Blob Data Contributor"

diff --git a/templates/shared_services/certs/terraform/variables.tf b/templates/shared_services/certs/terraform/variables.tf
@@ -14,3 +14,12 @@ variable "tre_resource_id" {
   type        = string
   description = "Resource ID"
 }
+
+variable "enable_cmk_encryption" {
+  type    = bool
+  default = false
+}
+
+variable "key_store_id" {
+  type = string
+}
diff --git a/templates/shared_services/cyclecloud/parameters.json b/templates/shared_services/cyclecloud/parameters.json
@@ -45,6 +45,18 @@
       "source": {
         "env": "ARM_ENVIRONMENT"
       }
+    },
+    {
+      "name": "enable_cmk_encryption",
+      "source": {
+        "env": "ENABLE_CMK_ENCRYPTION"
+      }
+    },
+    {
+      "name": "key_store_id",
+      "source": {
+        "env": "KEY_STORE_ID"
+      }
     }
   ]
 }
diff --git a/templates/shared_services/cyclecloud/porter.yaml b/templates/shared_services/cyclecloud/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-cyclecloud
-version: 0.6.7
+version: 0.7.0
 description: "An Azure TRE Shared Service Template for Azure Cyclecloud"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -46,6 +46,12 @@ parameters:
     env: ARM_ENVIRONMENT
     type: string
     default: "public"
+  - name: enable_cmk_encryption
+    type: boolean
+    default: false
+  - name: key_store_id
+    type: string
+    default: ""
 
 outputs:
   - name: connection_uri
@@ -74,6 +80,8 @@ install:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         arm_environment: ${ bundle.parameters.arm_environment }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -92,6 +100,8 @@ upgrade:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         arm_environment: ${ bundle.parameters.arm_environment }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -110,6 +120,8 @@ uninstall:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         arm_environment: ${ bundle.parameters.arm_environment }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

diff --git a/templates/shared_services/cyclecloud/terraform/data.tf b/templates/shared_services/cyclecloud/terraform/data.tf
@@ -0,0 +1,5 @@
+data "azurerm_user_assigned_identity" "tre_encryption_identity" {
+  count               = var.enable_cmk_encryption ? 1 : 0
+  name                = local.encryption_identity_name
+  resource_group_name = local.core_resource_group_name
+}
diff --git a/templates/shared_services/cyclecloud/terraform/locals.tf b/templates/shared_services/cyclecloud/terraform/locals.tf
@@ -8,4 +8,6 @@ locals {
     tre_id                = var.tre_id
     tre_shared_service_id = var.tre_resource_id
   }
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }