Function create_key_vault

infra/deploy_instance.py:615–778

Create a Key Vault, populate it with the .env secret as a backup/audit snapshot, then apply the SFI network lockdown. The Container App does NOT read this secret at runtime — the .env contents are passed inline to the Container App via the Bicep `envFileContents` @secure() para

(
    *,
    resource_group: str,
    location: str,
    vault_name: str,
    env_content: str,
    tags: list[str] | None = None,
)

def create_key_vault(
    *,
    resource_group: str,
    location: str,
    vault_name: str,
    env_content: str,
    tags: list[str] | None = None,
) -> str:
    """
    Create a Key Vault, populate it with the .env secret as a backup/audit
    snapshot, then apply the SFI network lockdown.

    The Container App does NOT read this secret at runtime — the .env contents
    are passed inline to the Container App via the Bicep `envFileContents`
    @secure() parameter. Azure Container Apps is not on Key Vault's
    "trusted services" list, so a locked-down KV would block runtime secret
    references. By passing the secret inline, we keep the runtime path
    independent of KV network access.

    The vault still receives the .env content as `env-global` to:
      - Provide a backup snapshot if the Container App is recreated.
      - Preserve the audit trail for the deployed configuration.

    The vault is created with public network access enabled so that the
    deployer (running from a corp network or dev container) can write the
    initial secret. After the secret is uploaded, the vault is locked down
    to publicNetworkAccess=Disabled + defaultAction=Deny + bypass=AzureServices
    to satisfy the S360 / NS221 Secure PaaS alert.

    Args:
        resource_group (str): The resource group name.
        location (str): The Azure region.
        vault_name (str): The Key Vault name.
        env_content (str): The prepared .env content to upload (with SQL connection string injected).
        tags (list[str] | None): Tags in 'Key=Value' format.

    Returns:
        str: The Key Vault resource ID.
    """
    logger.info("Creating Key Vault: %s", vault_name)
    kv_cmd = [
        "keyvault",
        "create",
        "--name",
        vault_name,
        "--resource-group",
        resource_group,
        "--location",
        location,
        "--enable-rbac-authorization",
        "true",
        "--enable-purge-protection",
        "true",
    ]
    if tags:
        kv_cmd += ["--tags"] + tags
    run_az(args=kv_cmd)