KeyVault.json

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "keyVaultName": {
            "type": "string",
            "metadata": {
                "description": "Name of the Key Vault"
            }
        },
        "location": {
            "type": "string",
            "metadata": {
                "description": "Location of the Key Vault"
            }
        },
        "accessPolicies": {
            "type": "array",
            "metadata": {
                "description": "An array of access policies objects"
            }
        },
        "skuName": {
            "type": "string",
            "defaultValue": "Standard",
            "allowedValues": [
                "Standard",
                "Premium"
            ],
            "metadata": {
                "description": "SKU for the vault"
            }
        },
        "enableVaultForDeployment": {
            "type": "bool",
            "defaultValue": false,
            "allowedValues": [
                true,
                false
            ],
            "metadata": {
                "description": "Specifies if the vault is enabled for a VM deployment"
            }
        },
        "enableVaultForDiskEncryption": {
            "type": "bool",
            "defaultValue": false,
            "allowedValues": [
                true,
                false
            ],
            "metadata": {
                "description": "Specifies if the azure platform has access to the vault for enabling disk encryption scenarios."
            }
        },
        "enabledForTemplateDeployment": {
            "type": "bool",
            "defaultValue": false,
            "allowedValues": [
                true,
                false
            ],
            "metadata": {
                "description": "Specifies whether Azure Resource Manager is permitted to retrieve secrets from the key vault."
            }
        },
        "enableSoftDelete": {
            "type": "bool",
            "defaultValue": true,
            "allowedValues": [
                true,
                false
            ],
            "metadata": {
                "description": "Property to specify whether the 'soft delete' functionality is enabled for this key vault."
            }
        },
        "omsWorkspaceResourceId": {
            "type": "string"
        }
    },
    "variables": {
        "productTag": "Key Vault 1.0"
    },
    "resources": [{
        "type": "Microsoft.KeyVault/vaults",
        "name": "[parameters('keyVaultName')]",
        "apiVersion": "2018-02-14",
        "location": "[parameters('location')]",
        "tags": {
            "Product": "[variables('productTag')]"
        },
        "properties": {
            "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
            "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
            "enabledForTemplateDeployment": "[parameters('enabledForTemplateDeployment')]",
            "enableSoftDelete": "[if(parameters('enableSoftDelete'), bool('true'), json('null'))]",
            "accessPolicies": "[parameters('accessPolicies')]",
            "sku": {
                "name": "[parameters('skuName')]",
                "family": "A"
            }
        },
        "resources": [{
                "type": "providers/diagnosticSettings",
                "name": "Microsoft.Insights/service",
                "dependsOn": [
                    "[parameters('keyVaultName')]"
                ],
                "apiVersion": "2015-07-01",
                "properties": {
                    "workspaceId": "[parameters('omsWorkspaceResourceId')]",
                    "logs": [{
                        "category": "AuditEvent",
                        "enabled": true,
                        "retentionPolicy": {
                            "days": 0,
                            "enabled": false
                        }
                    }]
                }
            },
            {
                "type": "Microsoft.KeyVault/vaults/providers/locks",
                "name": "[concat(parameters('keyVaultName'), '/Microsoft.Authorization/keyVaultLock')]",
                "apiVersion": "2015-06-01",
                "dependsOn": [
                    "[parameters('keyVaultName')]"
                ],
                "properties": {
                    "level": "CannotDelete",
                    "notes": "Key Vault should not be deleted"
                }
            }
        ]
    }]
}