Create Key Vault Infrastructure

# Implement Secure Key Vault Access Infrastructure Using VS Code Remote Tunnel

## Type
Story

---

## Priority
High

---

## Description

Design and implement a secure access pattern for Azure Key Vault instances where:

- Public network access is fully disabled
- IP whitelisting is not permitted
- Access must occur from isolated/private network environments
- Developers and support teams still require operational access to manage and retrieve secrets

The proposed solution is to deploy a secure management environment inside the private network and expose administrative access through a VS Code Remote Tunnel configuration using outbound HTTPS-only connectivity.

This approach avoids exposing inbound ports, public IPs, jump boxes, or VPN dependencies while still enabling authenticated access to Key Vault resources from approved developer workstations.

The environment will:

- Reside inside the spoke/private network with Key Vault private endpoint access
- Use outbound HTTPS internet access only
- Authenticate using Azure AD / Entra ID
- Allow secure secret management operations through VS Code Remote Tunnel sessions
- Eliminate the need for public IPs or network allowlisting

---

# Business Value

This solution provides a secure operational model for managing private-only Azure Key Vaults in highly restricted enterprise environments while maintaining compliance with security and networking standards.

Benefits include:

- No inbound connectivity required
- No public IP exposure
- No firewall/IP whitelist exceptions
- Secure developer operational access
- Reduced dependency on bastion/jump host infrastructure
- Improved auditability and centralized access control

---

# Proposed Architecture

1. Deploy lightweight Azure compute resource inside private VNet:
- Azure Container Instance (ACI)
- Linux VM
- Container App
- Dev Box
- or similar management host

2. Configure:
- Private DNS resolution for Key Vault private endpoint
- Outbound HTTPS internet connectivity
- Managed Identity or Azure CLI authentication

3. Install:
- Azure CLI
- VS Code CLI / Remote Tunnel
- Terraform / PowerShell tooling (optional)

4. Enable VS Code Remote Tunnel:
- Tunnel initiated outbound from private environment
- No inbound NSG/firewall rules required

5. Grant:
- Key Vault RBAC permissions
- Secret Officer / Secrets User roles as required

---

# Technical Requirements

- Key Vault public network access remains disabled
- Connectivity must work entirely through private endpoints
- No inbound ports exposed
- Tunnel communication must use outbound HTTPS only
- Support Entra ID authentication
- Support secret CRUD operations
- Support Terraform and Azure CLI workflows
- Validate DNS resolution through enterprise hub/spoke architecture

---

# Tasks

- [ ] Design target architecture for private Key Vault access
- [ ] Validate networking and DNS resolution requirements
- [ ] Deploy management host inside spoke VNet
- [ ] Configure outbound internet access
- [ ] Install VS Code Remote Tunnel tooling
- [ ] Configure secure authentication flow
- [ ] Configure RBAC access to Key Vault
- [ ] Test secret read/write operations
- [ ] Validate no inbound connectivity exists
- [ ] Document operational access process
- [ ] Create support/runbook documentation

---

# Acceptance Criteria

- Users can securely access private-only Key Vault secrets
- No public ingress exists
- No IP whitelist rules are required
- VS Code Remote Tunnel connectivity works through outbound HTTPS only
- Key Vault operations succeed through private endpoint routing
- RBAC and audit logging are validated
- Documentation and operational procedures are completed

---

# Dependencies

- Networking team support for private DNS validation
- Azure subscription access
- Key Vault RBAC permissions
- Outbound HTTPS connectivity approval
- VS Code Remote Tunnel organizational approval

---

# Risks / Considerations

- Enterprise proxy/firewall restrictions may impact tunnel connectivity
- Private DNS zone linkage must function correctly across hub/spoke networks
- RBAC propagation delays may impact initial testing
- Remote tunnel authentication policies may require security review