diff --git a/core/terraform/keyvault.tf b/core/terraform/keyvault.tf
index 5df7ddd05..a76c225bc 100644
--- a/core/terraform/keyvault.tf
+++ b/core/terraform/keyvault.tf
@@ -13,7 +13,7 @@ resource "azurerm_key_vault" "kv" {
   network_acls {
     default_action = local.kv_network_default_action
     bypass         = local.kv_network_bypass
-    ip_rules       = [ local.myip ]  # exception for deployment IP, this is removed in remove_deployment_network_exceptions.sh
+    ip_rules       = [local.myip] # exception for deployment IP, this is removed in remove_deployment_network_exceptions.sh
   }
 
   lifecycle {
@@ -23,7 +23,7 @@ resource "azurerm_key_vault" "kv" {
   # create provisioner required due to https://github.com/hashicorp/terraform-provider-azurerm/issues/18970
   #
   provisioner "local-exec" {
-    when = create
+    when    = create
     command = <<EOT
 az keyvault update --name ${local.kv_name} --public-network-access ${local.kv_public_network_access_enabled ? "Enabled" : "Disabled"} --default-action ${local.kv_network_default_action} --bypass ${local.kv_network_bypass} --output none
 az keyvault network-rule add --name ${local.kv_name} --ip-address ${local.myip} --output none
diff --git a/core/terraform/locals.tf b/core/terraform/locals.tf
index a2febc142..935e5c85c 100644
--- a/core/terraform/locals.tf
+++ b/core/terraform/locals.tf
@@ -52,8 +52,8 @@ locals {
   tre_deployment_network_exception_tag = "tre_deployment_network_exception"
 
   # key vault variables
-  kv_name = "kv-${var.tre_id}"
+  kv_name                          = "kv-${var.tre_id}"
   kv_public_network_access_enabled = true
-  kv_network_default_action = var.enable_local_debugging ? "Allow" : "Deny"
-  kv_network_bypass = "AzureServices"
+  kv_network_default_action        = var.enable_local_debugging ? "Allow" : "Deny"
+  kv_network_bypass                = "AzureServices"
 }