3

I am using terraform to deploy a SQL managed instance and need to store the 4 connection strings that come with it in azure key vault. According to terraform documentation for SQL managed instance: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/mssql_managed_instance connection string is not an attribute that is exported, so can't just do an output and reference it. How would I identify these connection strings to store them in key vault?

If it is not possible with terraform I am open to powershell/arm solutions

mattymac
  • 33
  • 1
  • 3
  • Sadly your question is not clear. Do you have any TF code to show which demonstrates your issue or what you want to do? – Marcin May 06 '22 at 00:33
  • Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking. – Community May 06 '22 at 06:44

1 Answers1

3

In general, you can store any secret in a key vault using terraform like so:

resource "azurerm_key_vault_secret" "example" {
  name         = "the-secret-name"
  value        = "the-secret-value"
  key_vault_id = var.keyvault_id
}

Every connection string follows a certain syntax so I would put these together as strings based on the name, admin user and admin password, and add them to the key vault, similar to this:

locals {
    username = "admin"
    password = "abc"
}

resource "azurerm_mssql_managed_instance" "example" {
  name                = "managedsqlinstance"
  resource_group_name = var.resource_group_name
  location            = var.location
  
  administrator_login          = local.username
  administrator_login_password = local.password
  ...
}
resource "azurerm_key_vault_secret" "example" {
  name         = "sql-connectionstring"
  value        = "Server=tcp:${azurerm_mssql_managed_instance.example.name}.database.windows.net,1433;Persist Security Info=False;User ID=${local.username};Password=${local.password};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
  key_vault_id = var.keyvault_id
}

To find the connection strings and their exact syntax, you should have a look at the sql managed instance that has been created in the azure portal.

Jules
  • 184
  • 1
  • 4
  • 1
    Thanks I appreciate the response. I was looking for a way to do it dynamically so terraform could grab the connection string from SQL MI, but it looks like SQL MI does not export connection string as a attribute (vs cosmos DB say, which does). Looking like Ill have to use powershell to fill in the remaining pieces – mattymac May 09 '22 at 14:34