[Feature Request]: Align CMK Implementation for Key Vault Key referencing across modules

[ahmadabdalla]

Description

Currently, our modules contain a combination of CMK Key object referencing mechanism. Also some of them contain different API versions of the Key Vault / Key being referenced (i.e. 2022-07-01 or 2021-10-01. 2021-06-01-preview)

Examples:

Automation Accounts, Batch, Cognitive Services, Container Instance, Service Bus, Synapse

resource cMKKeyVault 'Microsoft.KeyVault/vaults@2021-10-01' existing = if (!empty(cMKKeyVaultResourceId)) {
  name: last(split(cMKKeyVaultResourceId, '/'))!
  scope: resourceGroup(split(cMKKeyVaultResourceId, '/')[2], split(cMKKeyVaultResourceId, '/')[4])
}

resource cMKKeyVaultKey 'Microsoft.KeyVault/vaults/keys@2021-10-01' existing = if (!empty(cMKKeyVaultResourceId) && !empty(cMKKeyName)) {
  name: '${last(split(cMKKeyVaultResourceId, '/'))}/${cMKKeyName}'!
  scope: resourceGroup(split(cMKKeyVaultResourceId, '/')[2], split(cMKKeyVaultResourceId, '/')[4])
}

Container Registry, DB for PostgreSQL, Machine Learning, Synapse Keys

resource cMKKeyVaultKey 'Microsoft.KeyVault/vaults/keys@2021-10-01' existing = if (!empty(cMKKeyVaultResourceId) && !empty(cMKKeyName)) {
  name: '${last(split(cMKKeyVaultResourceId, '/'))}/${cMKKeyName}'
  scope: resourceGroup(split(cMKKeyVaultResourceId, '/')[2], split(cMKKeyVaultResourceId, '/')[4])
}

Data Factory, Storage Account

resource cMKKeyVault 'Microsoft.KeyVault/vaults@2021-10-01' existing = if (!empty(cMKKeyVaultResourceId)) {
  name: last(split(cMKKeyVaultResourceId, '/'))!
  scope: resourceGroup(split(cMKKeyVaultResourceId, '/')[2], split(cMKKeyVaultResourceId, '/')[4])
}

Following a recent discussion, we proposed aligning the method across modules to use the inner resource referencing approach as implemented in the following module (PR #2657)

DB for MySQL Flexible

resource cMKKeyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = if (!empty(cMKKeyVaultResourceId)) {
  name: last(split(cMKKeyVaultResourceId, '/'))!
  scope: resourceGroup(split(cMKKeyVaultResourceId, '/')[2], split(cMKKeyVaultResourceId, '/')[4])

  resource cMKKey 'keys@2022-07-01' existing = if (!empty(cMKKeyName)) {
    name: cMKKeyName
  }
}

We should revisit our modules that use CMK and see where we can have a consistent approach across all our modules for using CMK. May also require us to update our documentation for guidance.

[eriqua]

Suggestion

resource cMKKeyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = if (!empty(cMKKeyVaultResourceId) && (!empty(cMKKeyName)) ) {
  name: last(split(cMKKeyVaultResourceId, '/'))!
  scope: resourceGroup(split(cMKKeyVaultResourceId, '/')[2], split(cMKKeyVaultResourceId, '/')[4])

  resource cMKKey 'keys@2022-07-01' existing =  {
    name: cMKKeyName
  }
}

[ahmadabdalla]

Alexander Sehr (@AlexanderSehr) Erika Gressi (@eriqua) sounds like we need to create a vote :D

[eriqua]

Team decides to go on with the suggested implementation and address comments in the PR itself

[ahmadabdalla]

Erika Gressi (@eriqua) are you referring to your suggestion? or the one we did for #2657

[AlexanderSehr]

Should now be aligned as per the implementation of the corresponding AVM spec: https://azure.github.io/Azure-Verified-Modules/specs/shared/interfaces/#customer-managed-keys