From 7b8e3ad5dbd662af0d83be1cd5b452649a611719 Mon Sep 17 00:00:00 2001
From: juan-dl <juan.deus@prefapp.es>
Date: Tue, 4 Aug 2026 20:18:26 +0200
Subject: [PATCH] feat!: Change deprecated KV RBAC variable

---
 modules/azure-kv/README.md    | 6 +++---
 modules/azure-kv/main.tf      | 6 +++---
 modules/azure-kv/variables.tf | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/modules/azure-kv/README.md b/modules/azure-kv/README.md
index 2df9594a8..ab1224df3 100644
--- a/modules/azure-kv/README.md
+++ b/modules/azure-kv/README.md
@@ -38,8 +38,8 @@ No modules.
 | <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | The name of the resource group in which the Key Vault is created | `string` | n/a | yes |
 | <a name="input_sku_name"></a> [sku\_name](#input\_sku\_name) | The SKU name of the Key Vault (e.g., standard or premium) | `string` | n/a | yes |
 | <a name="input_soft_delete_retention_days"></a> [soft\_delete\_retention\_days](#input\_soft\_delete\_retention\_days) | The number of days that soft-deleted items are retained in the Key Vault | `number` | n/a | yes |
-| <a name="input_enable_rbac_authorization"></a> [enable_rbac_authorization](#input\_enable\_rbac\_authorization) | Set RBAC authorization for the Key Vault. Disable access policies authorization | `bool` | n/a | yes |
-| <a name="input_accesss_policies"></a> [access_policies](#input\_access\_policies) | Block for access policies definition. Will fail if `enable_rbac_authorization: true` | `list(object)` | n/a | optional |
+| <a name="input_rbac_authorization_enabled"></a> [rbac_authorization_enabled](#input\_enable\_rbac\_authorization) | Set RBAC authorization for the Key Vault. Disable access policies authorization | `bool` | n/a | yes |
+| <a name="input_accesss_policies"></a> [access_policies](#input\_access\_policies) | Block for access policies definition. Will fail if `rbac_authorization_enabled: true` | `list(object)` | n/a | optional |
 | <a name="input_accesss_policies.name"></a> [access_policies.name](#input\_access\_policies.name) | Name for the access policy. Display name in groups and SPN, user principal name in users and custom for `object_id` | `string` | n/a | optional |
 | <a name="input_accesss_policies.name.type"></a> [access_policies.name.type](#input\_access\_policies.name.type) | Entity type \[ group \| service_principal \| user \]. If we provide the `object_id` type value must be `""` | `string` | n/a | optional |
 | <a name="input_accesss_policies.name.object_id"></a> [access_policies.name.object_id](#input\_access\_policies.name.object_id) | Object ID of the entity. If we provide an entity type value must be `""` | `string` | n/a | optional |
@@ -70,7 +70,7 @@ No modules.
       soft_delete_retention_days: 7
       purge_protection_enabled: true
       sku_name: "standard"
-      enable_rbac_authorization: false # If RBAC is set to true access policies will fail if there are any defined.
+      rbac_authorization_enabled: false # If RBAC is set to true access policies will fail if there are any defined.
       access_policies:
       - name: "Name for the Object ID"
         type: "" # Leave empty value if you provide directly the object ID
diff --git a/modules/azure-kv/main.tf b/modules/azure-kv/main.tf
index 2bb2aa317..e6fea5486 100644
--- a/modules/azure-kv/main.tf
+++ b/modules/azure-kv/main.tf
@@ -52,7 +52,7 @@ locals {
   object_ids = [for id in local.entity_ids : id if id != null]
 
   # Check if access policies are defined when RBAC is enabled
-  has_access_policies = length(var.access_policies) > 0 && var.enable_rbac_authorization
+  has_access_policies = length(var.access_policies) > 0 && var.rbac_authorization_enabled
 }
 
 
@@ -65,7 +65,7 @@ resource "azurerm_key_vault" "this" {
   enabled_for_disk_encryption = var.enabled_for_disk_encryption
   tenant_id                   = data.azurerm_client_config.current.tenant_id
   soft_delete_retention_days  = var.soft_delete_retention_days
-  enable_rbac_authorization   = var.enable_rbac_authorization
+  rbac_authorization_enabled   = var.rbac_authorization_enabled
   purge_protection_enabled    = var.purge_protection_enabled
   sku_name                    = var.sku_name
   tags                        = var.tags_from_rg ? merge(data.azurerm_resource_group.this.tags, var.tags) : var.tags
@@ -77,7 +77,7 @@ resource "azurerm_key_vault" "this" {
   }
 
   dynamic "access_policy" {
-    for_each = var.enable_rbac_authorization ? [] : [for entity in var.access_policies : entity if lookup(local.entity_ids, entity.name, null) != null]
+    for_each = var.rbac_authorization_enabled ? [] : [for entity in var.access_policies : entity if lookup(local.entity_ids, entity.name, null) != null]
     content {
       tenant_id               = data.azurerm_client_config.current.tenant_id
       object_id               = lookup(local.entity_ids, access_policy.value.name, null)
diff --git a/modules/azure-kv/variables.tf b/modules/azure-kv/variables.tf
index ae4bcbc8d..faf95befb 100644
--- a/modules/azure-kv/variables.tf
+++ b/modules/azure-kv/variables.tf
@@ -22,7 +22,7 @@ variable "resource_group" {
   type = string
 }
 
-variable "enable_rbac_authorization" {
+variable "rbac_authorization_enabled" {
   type = bool
 }