Enable purge protection

[tanya-borisova]

TRE customers are usually expected to enable keyvault purge protection.

However, in the repo we have a flag keyvault_purge_protection_enabled, which has been useful in development scenarios, as we were often recreating resources in Azure.

Now, in the azurerm Terraform provider configuration,one can now set the following:

provider "azurerm" {
  features {
    key_vault {
      # Don't purge secrets on destroy (this would fail due to purge protection being enabled on keyvault)
      purge_soft_deleted_secrets_on_destroy = false
      # When recreating a shared service, recover any previously soft deleted secrets
      recover_soft_deleted_secrets = true
    }
  }
}

(See also PR #1777)

With this, there should not be a problem having purge protection on, because Terraform should not purge secrets on deletion, and should restore previously soft deleted secrets. So we should have purge protection on.

Purge protection is already enabled in #1797 for workspace keyvault, in this ticket enable it for the keyvault in core as well.

• Upgrade azurerm provider version to 3.5.0 #1925

[tanya-borisova]

The blocker of this work is that TLS certificate cannot be recovered after being deleted. The crux of the problem is described in this bug report for azurerm: hashicorp/terraform-provider-azurerm#17168

There might be a workaround possible if we don't import a temporary certificate and instead let Azure create one for us from parameters. I will do a timeboxed investigation into this.