diff --git a/modules/azure-kv/README.md b/modules/azure-kv/README.md
index 2df9594a8..ab1224df3 100644
--- a/modules/azure-kv/README.md
+++ b/modules/azure-kv/README.md
@@ -38,8 +38,8 @@ No modules.
| [resource\_group](#input\_resource\_group) | The name of the resource group in which the Key Vault is created | `string` | n/a | yes |
| [sku\_name](#input\_sku\_name) | The SKU name of the Key Vault (e.g., standard or premium) | `string` | n/a | yes |
| [soft\_delete\_retention\_days](#input\_soft\_delete\_retention\_days) | The number of days that soft-deleted items are retained in the Key Vault | `number` | n/a | yes |
-| [enable_rbac_authorization](#input\_enable\_rbac\_authorization) | Set RBAC authorization for the Key Vault. Disable access policies authorization | `bool` | n/a | yes |
-| [access_policies](#input\_access\_policies) | Block for access policies definition. Will fail if `enable_rbac_authorization: true` | `list(object)` | n/a | optional |
+| [rbac_authorization_enabled](#input\_enable\_rbac\_authorization) | Set RBAC authorization for the Key Vault. Disable access policies authorization | `bool` | n/a | yes |
+| [access_policies](#input\_access\_policies) | Block for access policies definition. Will fail if `rbac_authorization_enabled: true` | `list(object)` | n/a | optional |
| [access_policies.name](#input\_access\_policies.name) | Name for the access policy. Display name in groups and SPN, user principal name in users and custom for `object_id` | `string` | n/a | optional |
| [access_policies.name.type](#input\_access\_policies.name.type) | Entity type \[ group \| service_principal \| user \]. If we provide the `object_id` type value must be `""` | `string` | n/a | optional |
| [access_policies.name.object_id](#input\_access\_policies.name.object_id) | Object ID of the entity. If we provide an entity type value must be `""` | `string` | n/a | optional |
@@ -70,7 +70,7 @@ No modules.
soft_delete_retention_days: 7
purge_protection_enabled: true
sku_name: "standard"
- enable_rbac_authorization: false # If RBAC is set to true access policies will fail if there are any defined.
+ rbac_authorization_enabled: false # If RBAC is set to true access policies will fail if there are any defined.
access_policies:
- name: "Name for the Object ID"
type: "" # Leave empty value if you provide directly the object ID
diff --git a/modules/azure-kv/main.tf b/modules/azure-kv/main.tf
index 2bb2aa317..e6fea5486 100644
--- a/modules/azure-kv/main.tf
+++ b/modules/azure-kv/main.tf
@@ -52,7 +52,7 @@ locals {
object_ids = [for id in local.entity_ids : id if id != null]
# Check if access policies are defined when RBAC is enabled
- has_access_policies = length(var.access_policies) > 0 && var.enable_rbac_authorization
+ has_access_policies = length(var.access_policies) > 0 && var.rbac_authorization_enabled
}
@@ -65,7 +65,7 @@ resource "azurerm_key_vault" "this" {
enabled_for_disk_encryption = var.enabled_for_disk_encryption
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = var.soft_delete_retention_days
- enable_rbac_authorization = var.enable_rbac_authorization
+ rbac_authorization_enabled = var.rbac_authorization_enabled
purge_protection_enabled = var.purge_protection_enabled
sku_name = var.sku_name
tags = var.tags_from_rg ? merge(data.azurerm_resource_group.this.tags, var.tags) : var.tags
@@ -77,7 +77,7 @@ resource "azurerm_key_vault" "this" {
}
dynamic "access_policy" {
- for_each = var.enable_rbac_authorization ? [] : [for entity in var.access_policies : entity if lookup(local.entity_ids, entity.name, null) != null]
+ for_each = var.rbac_authorization_enabled ? [] : [for entity in var.access_policies : entity if lookup(local.entity_ids, entity.name, null) != null]
content {
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = lookup(local.entity_ids, access_policy.value.name, null)
diff --git a/modules/azure-kv/variables.tf b/modules/azure-kv/variables.tf
index ae4bcbc8d..faf95befb 100644
--- a/modules/azure-kv/variables.tf
+++ b/modules/azure-kv/variables.tf
@@ -22,7 +22,7 @@ variable "resource_group" {
type = string
}
-variable "enable_rbac_authorization" {
+variable "rbac_authorization_enabled" {
type = bool
}