resource kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: 'foo'
  location: 'eastus'
  properties: {
    sku: {
      name: 'standard'
      family: 'A'
    }
    tenantId: subscription().tenantId
  }
}

output kvuri string = kv.properties.vaultUri

param ci string
@description('DTAP dtap (DEV,TST,ACC,or PRD)')
@allowed([
  'DEV'
  'TST'
  'ACC'
  'PRD'
])
param dtap string
param location string = resourceGroup().location
@description('whether this Keyvault has VNET integration')
param privateInbound bool = false
@description('if disabled no public access is allow only through private endpoint')
param publicNetworkAccess string = 'Enabled' 
param sku string = 'standard'
param accessPolicies array = []
param enabledForDeployment bool = false
param enabledForRBAC bool = true
param enabledForTemplateDeployment bool = true
param enabledForDiskEncryption bool = false
param softDeleteRetentionInDays int = 90
param enablePurgeProtection bool = true
param suffix string = ''

@description('whether to create a new or recover a keyvault')
@allowed([
  'new'
  'existing'
])
param newOrExisting string = 'new'
@description('application name tag')
param applicationName string

var KeyVaultResourceName = empty(suffix) ? 'MSC-KEY-${toUpper(ci)}-${toUpper(dtap)}' : 'MSC-KEY-${toUpper(ci)}-${toUpper(dtap)}-${toUpper(suffix)}'
//var KeyVaultResourceName = 'MSC-KEY-${ci}-${dtap}'
var virtualNetworkRules = privateInbound ? [
  {
    id: existingVnet::backendsubnet.id
    ignoreMissingVnetServiceEndpoint: false
  }
] : []

var properties = (newOrExisting == 'new') ? {
  createMode: 'default'
  enabledForDeployment: enabledForDeployment
  enabledForTemplateDeployment: enabledForTemplateDeployment
  enabledForDiskEncryption: enabledForDiskEncryption
  enableRbacAuthorization: enabledForRBAC
  accessPolicies: accessPolicies
  tenantId: subscription().tenantId
  sku: {
    name: sku
    family: 'A'
  }
  enableSoftDelete: true
  softDeleteRetentionInDays: softDeleteRetentionInDays
  enablePurgeProtection: enablePurgeProtection
  networkAcls: {
    bypass: 'AzureServices'
    defaultAction: 'Deny'
    ipRules: []
    virtualNetworkRules: virtualNetworkRules
  }
  publicNetworkAccess: publicNetworkAccess
} : {
  createMode: 'recover'
  enabledForDeployment: enabledForDeployment
  enabledForTemplateDeployment: enabledForTemplateDeployment
  enabledForDiskEncryption: enabledForDiskEncryption
  enableRbacAuthorization: enabledForRBAC
  accessPolicies: accessPolicies
  tenantId: subscription().tenantId
  sku: {
    name: sku
    family: 'A'
  }
  enableSoftDelete: true
  softDeleteRetentionInDays: softDeleteRetentionInDays
  enablePurgeProtection: enablePurgeProtection
  networkAcls: {
    bypass: 'AzureServices'
    defaultAction: 'Deny'
    ipRules: []
    virtualNetworkRules: virtualNetworkRules
  }
  publicNetworkAccess: publicNetworkAccess
}


@description('gather existing vnet')
resource existingVnet 'Microsoft.Network/virtualNetworks@2021-08-01' existing = {
  name: 'MSC-VNW-${toUpper(ci)}-${toUpper(dtap)}'

  resource backendsubnet 'subnets' existing = {
    name: 'MSC-NET-${toUpper(ci)}-${toUpper(dtap)}-BACKEND'
  }
}


resource KeyVaultResource 'Microsoft.KeyVault/vaults@2023-07-01' = {
  tags: {
    'CCC template version': '2.0'
    'Application Name': applicationName
  }
  name: KeyVaultResourceName
  location: location
  properties: properties
}

output resource object = KeyVaultResource
output resourceId string = KeyVaultResource.id
output keyvaultName string = KeyVaultResourceName
output keyvaultUri string = KeyVaultResource.properties.vaultUri