// Azure Key Vault module (public access, no Private Endpoint)

@description('The environment name (DEV, IAT, Prod)')
param environment string

@description('The location for the Key Vault')
param location string

@description('Tags to apply to resources')
param tags object

@description('Unique token for resource naming')
param resourceToken string

@description('The tenant ID for Key Vault access')
param tenantId string = subscription().tenantId

var keyVaultName = 'kv-dbp-${toLower(environment)}-${take(resourceToken, 8)}'

resource keyVault 'Microsoft.KeyVault/vaults@2024-11-01' = {
  name: keyVaultName
  location: location
  tags: tags
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenantId
    enabledForDeployment: false
    enabledForDiskEncryption: true
    enabledForTemplateDeployment: true
    enableSoftDelete: true
    softDeleteRetentionInDays: 7
    enablePurgeProtection: true
    enableRbacAuthorization: true
    publicNetworkAccess: 'Enabled'
    networkAcls: {
      defaultAction: 'Allow'
      bypass: 'AzureServices'
    }
  }
}

output keyVaultName string = keyVault.name
output keyVaultId string = keyVault.id
output keyVaultUri string = keyVault.properties.vaultUri