Add role assignment for key vault

Author: marvinbuss

code/infra/roleassignments.tf

@@ -1,5 +1,11 @@
-resource "azurerm_role_assignment" "role_assignment_storage_function" {
+resource "azurerm_role_assignment" "function_role_assignment_storage" {
   scope                = azurerm_storage_account.storage.id
   role_definition_name = "Storage Blob Data Owner"
   principal_id         = azapi_resource.function.identity[0].principal_id
 }
+
+resource "azurerm_role_assignment" "function_role_assignment_key_vault" {
+  scope                = azurerm_key_vault.key_vault.id
+  role_definition_name = "Key Vault Secrets User"
+  principal_id         = azapi_resource.function.identity[0].principal_id
+}

code/infra/variables.tf

@@ -33,7 +33,7 @@ variable "tags" {
 }
 
 variable "vnet_id" {
-  description = "Specifies the resource ID of the Vnet used for the Data Landing Zone"
+  description = "Specifies the resource ID of the Vnet used for the Azure Function."
   type        = string
   sensitive   = false
   validation {
@@ -43,7 +43,7 @@ variable "vnet_id" {
 }
 
 variable "nsg_id" {
-  description = "Specifies the resource ID of the default network security group for the Data Landing Zone"
+  description = "Specifies the resource ID of the default network security group for the Azure Function."
   type        = string
   sensitive   = false
   validation {
@@ -53,7 +53,7 @@ variable "nsg_id" {
 }
 
 variable "route_table_id" {
-  description = "Specifies the resource ID of the default route table for the Data Landing Zone"
+  description = "Specifies the resource ID of the default route table for the Azure Function."
   type        = string
   sensitive   = false
   validation {
@@ -62,6 +62,17 @@ variable "route_table_id" {
   }
 }
 
+variable "python_version" {
+  description = "Specifies the python version of the Azure Function."
+  type        = string
+  sensitive   = false
+  default     = "3.10"
+  validation {
+    condition     = contains(["3.9", "3.10"], var.python_version)
+    error_message = "Please specify a valid Python version."
+  }
+}
+
 variable "private_dns_zone_id_blob" {
   description = "Specifies the resource ID of the private DNS zone for Azure Storage blob endpoints. Not required if DNS A-records get created via Azue Policy."
   type        = string