Secrets leak fix (do not merge)

.devcontainer/post-create-command.sh

@@ -3,3 +3,4 @@
 sudo apt update
 npm i -g npm@latest fuzz-run
 npm install
+chmod +x ./scripts/*.sh

azure.yaml

@@ -10,7 +10,7 @@ hooks:
     interactive: true
 
     # TODO: provide a cross platform way to run this script
-    run: ./scripts/database/restore.sh strapi_20230922
+    run: ./scripts/restore-db.sh strapi_20230922
 
 services:
   portal:

docker-compose.yml

@@ -77,9 +77,9 @@ services:
       STRAPI_DATABASE_USERNAME: postgres
       STRAPI_DATABASE_PASSWORD: PostgresPass
       STRAPI_DATABASE_NAME: strapi
-    command: ["./restore.sh", "strapi_20230922"]
+    command: ["./restore-db.sh", "strapi_20230922"]
     volumes:
-      - ./scripts/database:/scripts
+      - ./scripts:/scripts
     depends_on:
       postgres:
         condition: service_healthy

infra/app/key-vault-secrets.bicep

@@ -0,0 +1,50 @@
+// Add secrets to key vaults, to avoid
+// leaked secrets in Azure deployment log
+// leaked secrets in .env files
+
+param keyVaultName string
+
+// POSTGRESQL PASSWORD - NAME in KEY VAULT
+param administratorLoginPasswordSecretName string = 'STRAPI-DATABASE-PASSWORD'
+@secure()
+param administratorLoginPasswordKSecretValue string
+
+// COSMOS DB CONNECTION STRING - NAME in KEY VAULT
+param cosmosDbSecretName = 'AZURE-COSMOS-CONNECTION-STRING'
+@secure()
+param cosmosDbSecretNameValue string
+
+// APP INSIGHT CONNECTION STRING - NAME in KEY VAULT
+param appInsightsConnectionStringName string = 'APPLICATIONINSIGHTS-CONNECTION-STRING'
+@secure ()
+param appInsightsConnectionStringValue string
+
+// POSTGRESQL PASSWORD
+resource postgresPassword 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
+  parent: keyVault
+  name: administratorLoginPasswordSecretName
+  properties: {
+    value: administratorLoginPasswordKSecretValue
+  }
+}
+
+// COSMOS DB CONNECTION STRING
+resource cosmosDbConnectionString 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
+  parent: keyVault
+  name: cosmosDbSecretName
+  properties: {
+    value: cosmosDbSecretNameValue
+  }
+}
+
+// APPLICATIONINSIGHTS CONNECTION STRING
+resource appInsightsConnectionString 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
+  parent: keyVault
+  name: appInsightsConnectionStringName
+  properties: {
+    value: appInsightsConnectionStringValue
+  }
+}
+resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
+  name: keyVaultName
+}

infra/core/database/postgresql/flexibleserver.bicep

@@ -76,4 +76,4 @@ resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
 }
 
 output POSTGRES_SERVER_NAME string = postgresServer.name
-output POSTGRES_DOMAIN_NAME string = postgresServer.properties.fullyQualifiedDomainName
+output POSTGRES_DOMAIN_NAME string = postgresServer.properties.fullyQualifiedDomainName

infra/core/monitor/monitoring.bicep

@@ -28,4 +28,4 @@ output applicationInsightsConnectionString string = applicationInsights.outputs.
 output applicationInsightsInstrumentationKey string = applicationInsights.outputs.instrumentationKey
 output applicationInsightsName string = applicationInsights.outputs.name
 output logAnalyticsWorkspaceId string = logAnalytics.outputs.id
-output logAnalyticsWorkspaceName string = logAnalytics.outputs.name
+output logAnalyticsWorkspaceName string = logAnalytics.outputs.name

infra/main.bicep

@@ -96,6 +96,7 @@ module monitoring './core/monitor/monitoring.bicep' = {
   params: {
     location: location
     tags: tags
+    keyVaultName: keyVault.outputs.name
     logAnalyticsName: !empty(logAnalyticsName) ? logAnalyticsName : '${abbrs.operationalInsightsWorkspaces}${resourceToken}'
     applicationInsightsName: !empty(applicationInsightsName) ? applicationInsightsName : '${abbrs.insightsComponents}${resourceToken}'
     applicationInsightsDashboardName: !empty(applicationInsightsDashboardName) ? applicationInsightsDashboardName : '${abbrs.portalDashboards}${resourceToken}'
@@ -244,16 +245,15 @@ module api './app/api.bicep' = {
     storageAccountName: storageAccount.outputs.name
     allowedOrigins: [ portal.outputs.SERVICE_WEB_URI ]
     appSettings: {
-      AZURE_COSMOS_CONNECTION_STRING_KV: cosmos.outputs.connectionStringKey
-      AZURE_COSMOS_CONNECTION_STRING_KEY: cosmos.outputs.connectionString
       AZURE_COSMOS_DATABASE_NAME: cosmos.outputs.databaseName
       AZURE_COSMOS_ENDPOINT: cosmos.outputs.endpoint
       STRAPI_DATABASE_NAME: cmsDatabaseName
       STRAPI_DATABASE_USERNAME: cmsDatabaseUser
-      STRAPI_DATABASE_PASSWORD: cmsDatabasePassword
       STRAPI_DATABASE_HOST: cmsDB.outputs.POSTGRES_DOMAIN_NAME
       STRAPI_DATABASE_PORT: cmsDatabasePort
       STRAPI_DATABASE_SSL: 'true'
+      AZURE_KEY_VAULT_NAME: keyVault.outputs.name
+      APPLICATIONINSIGHTS_NAME: monitoring.outputs.applicationInsightsName
     }
 
     // Note:  this property is passed as params to avoid circular dependency (see api.bicep)
@@ -352,6 +352,18 @@ module stripe './app/stripe.bicep' = {
   }
 }
 
+//////////////// KEY VAULT secrets  /////////////////////////
+module keyVaultSecrets './app/key-vault-secrets.bicep' = {
+  name: 'keyVaultSecrets'
+  scope: rg
+  params: {
+    keyVaultName: keyVaultName
+    administratorLoginPasswordKSecretValue: cmsDatabasePassword
+    cosmosDbSecretNameValue: cosmos.outputs.connectionStringKey
+    appInsightsConnectionStringValue: monitoring.outputs.applicationInsightsConnectionString
+  }
+}
+
 module eventGrid './app/events.bicep' = {
   name: 'events'
   scope: rg
@@ -364,11 +376,9 @@ module eventGrid './app/events.bicep' = {
 }
 
 // Data outputs
-output AZURE_COSMOS_CONNECTION_STRING_KEY string = cosmos.outputs.connectionStringKey
 output AZURE_COSMOS_DATABASE_NAME string = cosmos.outputs.databaseName
 
 // App outputs
-output APPLICATIONINSIGHTS_CONNECTION_STRING string = monitoring.outputs.applicationInsightsConnectionString
 output APPLICATIONINSIGHTS_NAME string = monitoring.outputs.applicationInsightsName
 
 output AZURE_CONTAINER_ENVIRONMENT_NAME string = containerApps.outputs.environmentName
@@ -405,5 +415,3 @@ output STRAPI_DATABASE_HOST string = cmsDB.outputs.POSTGRES_DOMAIN_NAME
 output STRAPI_DATABASE_PORT string = cmsDatabasePort
 
 output CMS_DATABASE_SERVER_NAME string = cmsDB.outputs.POSTGRES_SERVER_NAME
-// We need this to manually restore the database
-output STRAPI_DATABASE_PASSWORD string = cmsDatabasePassword

infra/main.parameters.json

@@ -27,13 +27,13 @@
       "value": "$(secretOrRandomPassword)"
     },
     "stripePublicKey": {
-      "value": "${STRIPE_PUBLIC_KEY}"
+      "value": "${STRIPE_PUBLIC_KEY=''}"
     },
     "stripeSecretKey": {
-      "value": "${STRIPE_SECRET_KEY}"
+      "value": "${STRIPE_SECRET_KEY=''}"
     },
     "stripeWebhookSecret": {
-      "value": "${STRIPE_WEBHOOK_SECRET}"
+      "value": "${STRIPE_WEBHOOK_SECRET=''}"
     },
     "cmsDatabaseHost": {
       "value": "${SERVICE_CMS_SERVER_HOST}"