Add CMK support for Cosmos DB (core)

CHANGELOG.md

@@ -14,7 +14,7 @@ ENHANCEMENTS:
 * Update Terraform to use Azure AD authentication rather than storage account keys ([#4103](https://github.com/microsoft/AzureTRE/issues/4103))
 * Update obsolete Terraform properties ([#4136](https://github.com/microsoft/AzureTRE/issues/4136))
 * Update Guacamole version and dependencies ([#4140](https://github.com/microsoft/AzureTRE/issues/4140))
-* Add partial (core resources only) support for customer managed keys  ([#4141](https://github.com/microsoft/AzureTRE/issues/4142))
+* Add partial (core resources only) support for customer managed keys  ([#4141](https://github.com/microsoft/AzureTRE/issues/4142),  [#4144](https://github.com/microsoft/AzureTRE/issues/4144))
 * Update the Azure CLI version to 2.67.0 in dev container and vmss ([#4157](https://github.com/microsoft/AzureTRE/pull/4157))
 
 BUG FIXES:

core/terraform/api-identity.tf

@@ -57,4 +57,6 @@ resource "azurerm_cosmosdb_sql_role_assignment" "tre_db_contributor" {
   role_definition_id  = data.azurerm_cosmosdb_sql_role_definition.cosmosdb_db_contributor.id
   principal_id        = azurerm_user_assigned_identity.id.principal_id
   scope               = azurerm_cosmosdb_account.tre_db_account.id
+
+  depends_on = [null_resource.tre_db_account_enable_cmk]
 }

core/terraform/cosmos_mongo.tf

@@ -35,11 +35,38 @@ resource "azurerm_cosmosdb_account" "mongo" {
     failover_priority = 0
   }
 
+  dynamic "identity" {
+    for_each = var.enable_cmk_encryption ? [1] : []
+    content {
+      type         = "UserAssigned"
+      identity_ids = [azurerm_user_assigned_identity.encryption[0].id]
+    }
+  }
+
+  default_identity_type = var.enable_cmk_encryption ? "UserAssignedIdentity=${azurerm_user_assigned_identity.encryption[0].id}" : null
+
   tags = local.tre_core_tags
 
-  lifecycle { ignore_changes = [tags] }
+  # since key_vault_key_id is created by the 'mongo_enable_cmk' null_resource, terraform forces re-creation of the resource
+  lifecycle { ignore_changes = [tags, key_vault_key_id] }
+}
+
+# Using the az CLI command since terraform forces a re-creation of the resource
+# https://github.com/hashicorp/terraform-provider-azurerm/issues/24781
+resource "null_resource" "mongo_enable_cmk" {
+  count = var.enable_cmk_encryption ? 1 : 0
+
+  provisioner "local-exec" {
+    command = "az cosmosdb update --name ${azurerm_cosmosdb_account.mongo.name} --resource-group ${azurerm_cosmosdb_account.mongo.resource_group_name} --key-uri ${azurerm_key_vault_key.tre_encryption[0].versionless_id}"
+  }
+
+  depends_on = [
+    azurerm_cosmosdb_account.mongo,
+    azurerm_role_assignment.kv_encryption_key_user[0]
+  ]
 }
 
+
 resource "azurerm_cosmosdb_mongo_database" "mongo" {
   name                = "porter"
   resource_group_name = azurerm_resource_group.core.name

core/terraform/main.tf

@@ -21,6 +21,10 @@ terraform {
       source  = "Azure/azapi"
       version = "~> 1.15.0"
     }
+    null = {
+      source  = "hashicorp/null"
+      version = "~> 3.2"
+    }
   }
 
   backend "azurerm" {}

core/terraform/statestore.tf

@@ -16,6 +16,16 @@ resource "azurerm_cosmosdb_account" "tre_db_account" {
     }
   }
 
+  dynamic "identity" {
+    for_each = var.enable_cmk_encryption ? [1] : []
+    content {
+      type         = "UserAssigned"
+      identity_ids = [azurerm_user_assigned_identity.encryption[0].id]
+    }
+  }
+
+  default_identity_type = var.enable_cmk_encryption ? "UserAssignedIdentity=${azurerm_user_assigned_identity.encryption[0].id}" : null
+
   consistency_policy {
     consistency_level       = "BoundedStaleness"
     max_interval_in_seconds = 10
@@ -27,7 +37,8 @@ resource "azurerm_cosmosdb_account" "tre_db_account" {
     failover_priority = 0
   }
 
-  lifecycle { ignore_changes = [tags] }
+  # since key_vault_key_id is created by the 'tre_db_account_enable_cmk' null_resource, terraform forces re-creation of the resource
+  lifecycle { ignore_changes = [tags, key_vault_key_id] }
 }
 
 moved {
@@ -95,3 +106,18 @@ resource "azurerm_private_endpoint" "sspe" {
     subresource_names              = ["Sql"]
   }
 }
+
+# Using the az CLI command since terraform forces a re-creation of the resource
+# https://github.com/hashicorp/terraform-provider-azurerm/issues/24781
+resource "null_resource" "tre_db_account_enable_cmk" {
+  count = var.enable_cmk_encryption ? 1 : 0
+
+  provisioner "local-exec" {
+    command = "az cosmosdb update --name ${azurerm_cosmosdb_account.tre_db_account.name} --resource-group ${azurerm_cosmosdb_account.tre_db_account.resource_group_name} --key-uri ${azurerm_key_vault_key.tre_encryption[0].versionless_id}"
+  }
+
+  depends_on = [
+    azurerm_cosmosdb_account.tre_db_account,
+    azurerm_role_assignment.kv_encryption_key_user[0]
+  ]
+}

core/terraform/storage.tf

@@ -7,7 +7,6 @@ resource "azurerm_storage_account" "stg" {
   allow_nested_items_to_be_public  = false
   cross_tenant_replication_enabled = false
 
-
   dynamic "identity" {
     for_each = var.enable_cmk_encryption ? [1] : []
     content {

core/version.txt

@@ -1 +1 @@
-__version__ = "0.11.3"
+__version__ = "0.11.4"