CMK Encryption support for resources in templates

CHANGELOG.md

@@ -20,6 +20,7 @@ ENHANCEMENTS:
 * Move Github PR bot commands into main documentation ([#4167](https://github.com/microsoft/AzureTRE/pull/4167))
 * Block Authentication with keys to CosmosDB SQL account ([#4175](https://github.com/microsoft/AzureTRE/pull/4175))
 * Add support for customer-managed keys encryption in base workspace ([#4161](https://github.com/microsoft/AzureTRE/pull/4161))
+* Add support for customer-managed keys encryption in templates ([#4145](https://github.com/microsoft/AzureTRE/issues/4145))
 
 BUG FIXES:
 - Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))

core/terraform/cmk_encryption.tf

@@ -4,7 +4,7 @@ resource "azurerm_user_assigned_identity" "encryption" {
   location            = azurerm_resource_group.core.location
   tags                = local.tre_core_tags
 
-  name = "id-encryption-${var.tre_id}"
+  name = local.encryption_identity_name
 
   lifecycle { ignore_changes = [tags] }
 }

core/terraform/locals.tf

@@ -44,5 +44,6 @@ locals {
   # The key store for encryption keys could either be external or created by terraform
   key_store_id = var.enable_cmk_encryption ? (var.external_key_store_id != null ? var.external_key_store_id : data.azurerm_key_vault.encryption_kv[0].id) : ""
 
-  cmk_name = "tre-encryption-${var.tre_id}"
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }

core/version.txt

@@ -1 +1 @@
-__version__ = "0.11.9"
+__version__ = "0.11.10"

docs/tre-admins/customer-managed-keys.md

@@ -2,11 +2,6 @@
 
 You can enable customer-managed keys (CMK) for supporting resources in Azure TRE.
 
-!!! warning
-    Currently Azure TRE only supports CMK encryption for resources in the TRE core and Base Workspace.
-    CMK encryption is not supported for the rest of the resources such as those deployed by a TRE workspace.
-
-
 !!! caution
     Currently, it is not possible to redeploy TRE with CMK enabled if it has previously been deployed without it. This is due to limitations of resources such as Azure Container Registry (ACR) that only allow enabling the CMK encryption at the time of resource creation.
 

templates/shared_services/admin-vm/parameters.json

@@ -45,6 +45,18 @@
       "source": {
         "env": "ARM_ENVIRONMENT"
       }
+    },
+    {
+      "name": "enable_cmk_encryption",
+      "source": {
+        "env": "ENABLE_CMK_ENCRYPTION"
+      }
+    },
+    {
+      "name": "key_store_id",
+      "source": {
+        "env": "KEY_STORE_ID"
+      }
     }
   ]
 }

templates/shared_services/admin-vm/porter.yaml

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-admin-vm
-version: 0.4.8
+version: 0.5.0
 description: "An admin vm shared service"
 dockerfile: Dockerfile.tmpl
 registry: azuretre
@@ -44,6 +44,12 @@ parameters:
     env: ADMIN_JUMPBOX_VM_SKU
     type: string
     default: Standard_B2s
+  - name: enable_cmk_encryption
+    type: boolean
+    default: false
+  - name: key_store_id
+    type: string
+    default: ""
 
 mixins:
   - terraform:
@@ -56,6 +62,8 @@ install:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -71,6 +79,8 @@ upgrade:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -86,6 +96,8 @@ uninstall:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         admin_jumpbox_vm_sku: ${ bundle.parameters.admin_jumpbox_vm_sku }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

templates/shared_services/admin-vm/terraform/admin-jumpbox.tf

@@ -45,14 +45,30 @@ resource "azurerm_windows_virtual_machine" "jumpbox" {
   }
 
   os_disk {
-    name                 = "vm-dsk-${var.tre_id}"
-    caching              = "ReadWrite"
-    storage_account_type = "Standard_LRS"
+    name                   = "vm-dsk-${var.tre_id}"
+    caching                = "ReadWrite"
+    storage_account_type   = "Standard_LRS"
+    disk_encryption_set_id = var.enable_cmk_encryption ? azurerm_disk_encryption_set.jumpbox_disk_encryption[0].id : null
   }
 
   lifecycle { ignore_changes = [tags] }
 }
 
+resource "azurerm_disk_encryption_set" "jumpbox_disk_encryption" {
+  count                     = var.enable_cmk_encryption ? 1 : 0
+  name                      = "vmss-disk-encryption-jumpbox-${var.tre_id}-${var.tre_resource_id}"
+  location                  = data.azurerm_resource_group.rg.location
+  resource_group_name       = data.azurerm_resource_group.rg.name
+  key_vault_key_id          = data.azurerm_key_vault_key.tre_encryption_key[0].versionless_id
+  encryption_type           = "EncryptionAtRestWithPlatformAndCustomerKeys"
+  auto_key_rotation_enabled = true
+
+  identity {
+    type         = "UserAssigned"
+    identity_ids = [data.azurerm_user_assigned_identity.tre_encryption_identity[0].id]
+  }
+}
+
 resource "azurerm_key_vault_secret" "jumpbox_credentials" {
   name         = "${azurerm_windows_virtual_machine.jumpbox.name}-jumpbox-password"
   value        = random_password.password.result

templates/shared_services/admin-vm/terraform/data.tf

@@ -11,3 +11,15 @@ data "azurerm_key_vault" "keyvault" {
 data "azurerm_resource_group" "rg" {
   name = local.core_resource_group_name
 }
+
+data "azurerm_key_vault_key" "tre_encryption_key" {
+  count        = var.enable_cmk_encryption ? 1 : 0
+  name         = local.cmk_name
+  key_vault_id = var.key_store_id
+}
+
+data "azurerm_user_assigned_identity" "tre_encryption_identity" {
+  count               = var.enable_cmk_encryption ? 1 : 0
+  name                = local.encryption_identity_name
+  resource_group_name = local.core_resource_group_name
+}

templates/shared_services/admin-vm/terraform/locals.tf

@@ -6,4 +6,6 @@ locals {
     tre_id                = var.tre_id
     tre_shared_service_id = var.tre_resource_id
   }
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }

templates/shared_services/admin-vm/terraform/variables.tf

@@ -11,3 +11,12 @@ variable "tre_resource_id" {
 variable "admin_jumpbox_vm_sku" {
   type = string
 }
+
+variable "enable_cmk_encryption" {
+  type    = bool
+  default = false
+}
+
+variable "key_store_id" {
+  type = string
+}

templates/shared_services/certs/parameters.json

@@ -57,6 +57,18 @@
       "source": {
         "env": "ARM_ENVIRONMENT"
       }
+    },
+    {
+      "name": "enable_cmk_encryption",
+      "source": {
+        "env": "ENABLE_CMK_ENCRYPTION"
+      }
+    },
+    {
+      "name": "key_store_id",
+      "source": {
+        "env": "KEY_STORE_ID"
+      }
     }
   ]
 }

templates/shared_services/certs/porter.yaml

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-certs
-version: 0.6.1
+version: 0.7.0
 description: "An Azure TRE shared service to generate certificates for a specified internal domain using Letsencrypt"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -51,6 +51,12 @@ parameters:
   - name: id
     type: string
     description: "Resource ID"
+  - name: enable_cmk_encryption
+    type: boolean
+    default: false
+  - name: key_store_id
+    type: string
+    default: ""
 
 mixins:
   - exec
@@ -67,6 +73,8 @@ install:
         domain_prefix: ${ bundle.parameters.domain_prefix }
         cert_name: ${ bundle.parameters.cert_name }
         tre_resource_id: ${ bundle.parameters.id }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -116,7 +124,6 @@ install:
         resource-group: ${ bundle.outputs.resource_group_name }
         name: ${ bundle.outputs.application_gateway_name }
 
-
 upgrade:
   - exec:
       description: "Upgrade shared service"
@@ -132,6 +139,8 @@ uninstall:
         domain_prefix: ${ bundle.parameters.domain_prefix }
         cert_name: ${ bundle.parameters.cert_name }
         tre_resource_id: ${ bundle.parameters.id }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

templates/shared_services/certs/terraform/data.tf

@@ -1,5 +1,3 @@
-data "azurerm_client_config" "current" {}
-
 data "azurerm_resource_group" "rg" {
   name = "rg-${var.tre_id}"
 }
@@ -19,3 +17,9 @@ data "azurerm_user_assigned_identity" "resource_processor_vmss_id" {
   name                = "id-vmss-${var.tre_id}"
   resource_group_name = "rg-${var.tre_id}"
 }
+
+data "azurerm_user_assigned_identity" "tre_encryption_identity" {
+  count               = var.enable_cmk_encryption ? 1 : 0
+  name                = local.encryption_identity_name
+  resource_group_name = data.azurerm_resource_group.rg.name
+}

templates/shared_services/certs/terraform/locals.tf

@@ -23,4 +23,7 @@ locals {
     tre_id                = var.tre_id
     tre_shared_service_id = var.tre_resource_id
   }
+
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }

templates/shared_services/certs/terraform/staticweb.tf

@@ -6,6 +6,8 @@ resource "azurerm_storage_account" "staticweb" {
   account_kind                     = "StorageV2"
   account_tier                     = "Standard"
   account_replication_type         = "LRS"
+  table_encryption_key_type        = var.enable_cmk_encryption ? "Account" : "Service"
+  queue_encryption_key_type        = var.enable_cmk_encryption ? "Account" : "Service"
   enable_https_traffic_only        = true
   allow_nested_items_to_be_public  = false
   cross_tenant_replication_enabled = false
@@ -19,9 +21,25 @@ resource "azurerm_storage_account" "staticweb" {
     error_404_document = "404.html"
   }
 
+  dynamic "identity" {
+    for_each = var.enable_cmk_encryption ? [1] : []
+    content {
+      type         = "UserAssigned"
+      identity_ids = [data.azurerm_user_assigned_identity.tre_encryption_identity[0].id]
+    }
+  }
+
   lifecycle { ignore_changes = [infrastructure_encryption_enabled, tags] }
 }
 
+resource "azurerm_storage_account_customer_managed_key" "staticweb_stg_encryption" {
+  count                     = var.enable_cmk_encryption ? 1 : 0
+  storage_account_id        = azurerm_storage_account.staticweb.id
+  key_vault_id              = var.key_store_id
+  key_name                  = local.cmk_name
+  user_assigned_identity_id = data.azurerm_user_assigned_identity.tre_encryption_identity[0].id
+}
+
 resource "azurerm_role_assignment" "stgwriter" {
   scope                = azurerm_storage_account.staticweb.id
   role_definition_name = "Storage Blob Data Contributor"

templates/shared_services/certs/terraform/variables.tf

@@ -14,3 +14,12 @@ variable "tre_resource_id" {
   type        = string
   description = "Resource ID"
 }
+
+variable "enable_cmk_encryption" {
+  type    = bool
+  default = false
+}
+
+variable "key_store_id" {
+  type = string
+}

templates/shared_services/cyclecloud/parameters.json

@@ -45,6 +45,18 @@
       "source": {
         "env": "ARM_ENVIRONMENT"
       }
+    },
+    {
+      "name": "enable_cmk_encryption",
+      "source": {
+        "env": "ENABLE_CMK_ENCRYPTION"
+      }
+    },
+    {
+      "name": "key_store_id",
+      "source": {
+        "env": "KEY_STORE_ID"
+      }
     }
   ]
 }

templates/shared_services/cyclecloud/porter.yaml

@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-cyclecloud
-version: 0.6.7
+version: 0.7.0
 description: "An Azure TRE Shared Service Template for Azure Cyclecloud"
 registry: azuretre
 dockerfile: Dockerfile.tmpl
@@ -46,6 +46,12 @@ parameters:
     env: ARM_ENVIRONMENT
     type: string
     default: "public"
+  - name: enable_cmk_encryption
+    type: boolean
+    default: false
+  - name: key_store_id
+    type: string
+    default: ""
 
 outputs:
   - name: connection_uri
@@ -74,6 +80,8 @@ install:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         arm_environment: ${ bundle.parameters.arm_environment }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -92,6 +100,8 @@ upgrade:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         arm_environment: ${ bundle.parameters.arm_environment }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"
@@ -110,6 +120,8 @@ uninstall:
         tre_id: ${ bundle.parameters.tre_id }
         tre_resource_id: ${ bundle.parameters.id }
         arm_environment: ${ bundle.parameters.arm_environment }
+        enable_cmk_encryption: ${ bundle.parameters.enable_cmk_encryption }
+        key_store_id: ${ bundle.parameters.key_store_id }
       backendConfig:
         use_azuread_auth: "true"
         use_oidc: "true"

templates/shared_services/cyclecloud/terraform/data.tf

@@ -0,0 +1,5 @@
+data "azurerm_user_assigned_identity" "tre_encryption_identity" {
+  count               = var.enable_cmk_encryption ? 1 : 0
+  name                = local.encryption_identity_name
+  resource_group_name = local.core_resource_group_name
+}

templates/shared_services/cyclecloud/terraform/locals.tf

@@ -8,4 +8,6 @@ locals {
     tre_id                = var.tre_id
     tre_shared_service_id = var.tre_resource_id
   }
+  cmk_name                 = "tre-encryption-${var.tre_id}"
+  encryption_identity_name = "id-encryption-${var.tre_id}"
 }