# Azure Key Vault Configuration for DPDPA Personal Data Encryption
# Version: 1.0 | Date: 2026-04-02 | Legal Reference: DPDPA Rule 6(1)(a)

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

variable "location" {
  description = "Azure region: centralindia, southindia"
  default     = "centralindia"
}

variable "environment" {
  default = "production"
}

data "azurerm_client_config" "current" {}

resource "azurerm_resource_group" "kms" {
  name     = "rg-dpdpa-kms-${var.environment}"
  location = var.location
}

resource "azurerm_key_vault" "personal_data" {
  name                        = "kv-dpdpa-${var.environment}"
  location                    = azurerm_resource_group.kms.location
  resource_group_name         = azurerm_resource_group.kms.name
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  sku_name                    = "premium"  # Premium for HSM-backed keys
  soft_delete_retention_days  = 90
  purge_protection_enabled    = true  # Prevent accidental key deletion

  # Network ACLs (restrict to specific VNets in production)
  network_acls {
    default_action = "Deny"
    bypass         = "AzureServices"
    # Add your VNet subnet IDs:
    # virtual_network_subnet_ids = [azurerm_subnet.app.id]
    ip_rules = []  # Add your IP whitelist
  }

  tags = {
    Environment        = var.environment
    Compliance         = "DPDPA-Rule-6-1-a"
    DataClassification = "personal_data"
  }
}

resource "azurerm_key_vault_key" "personal_data" {
  name         = "personal-data-encryption-key"
  key_vault_id = azurerm_key_vault.personal_data.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]

  rotation_policy {
    automatic {
      time_before_expiry = "P30D"  # Rotate 30 days before expiry
    }

    expire_after         = "P365D"  # Annual rotation
    notify_before_expiry = "P60D"
  }

  tags = {
    Environment = var.environment
    Compliance  = "DPDPA-Rule-6-1-a"
  }
}

# Grant key permissions to Managed Identities (replace with your app identity)
resource "azurerm_key_vault_access_policy" "app" {
  key_vault_id = azurerm_key_vault.personal_data.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  # object_id    = azurerm_user_assigned_identity.app.principal_id  # Your app identity

  key_permissions = [
    "Get",
    "Decrypt",
    "Encrypt",
    "WrapKey",
    "UnwrapKey"
  ]
}

# Diagnostic logging to Log Analytics
resource "azurerm_monitor_diagnostic_setting" "key_vault" {
  name                       = "kv-audit-logs"
  target_resource_id         = azurerm_key_vault.personal_data.id
  # log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id  # Your workspace

  enabled_log {
    category = "AuditEvent"
  }

  metric {
    category = "AllMetrics"
  }
}

output "key_vault_id" {
  value = azurerm_key_vault.personal_data.id
}

output "key_vault_uri" {
  value = azurerm_key_vault.personal_data.vault_uri
}

output "encryption_key_id" {
  value = azurerm_key_vault_key.personal_data.id
}