azurerm_key_vault_key inconsistent behaviour

[4c74356b41]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.7

AzureRM Provider Version

3.75.0, 3.104.0

Affected Resource(s)/Data Source(s)

azurerm_key_vault_key

Terraform Configuration Files

resource "azurerm_key_vault_key" "cmk_key" {
  name         = "${local.container_registry_name}cmkkey${var.cmk_name_suffix}"
  key_vault_id = var.key_vault_id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]

  rotation_policy {
    automatic {
      time_before_expiry = "P30D"
    }
    expire_after         = "P90D"
    notify_before_expiry = "P29D"
  }
}

Debug Output/Panic Output

AzureRM Response for https://management.azure.com/subscriptions/xyz/providers/Microsoft.KeyVault/vaults?%24skiptoken=%token%&api-version=2023-02-01:
...
Unable to determine the Resource ID for the Key Vault at URL "https://redacted.vault.azure.net/" - removing from state!: timestamp=2024-05-17T12:10:05.959Z

Expected Behaviour

if apply works next plan shouldn't fail with the error above

Actual Behaviour

apply works, plan thinks that resource does not exist

Steps to Reproduce

No response

Important Factoids

No response

References

The above happens when the key_vault_id references a key vault in another subscription

[manicminer]

Thanks for reporting this issue @4c74356b41. Unfortunately, in this case I would say that the bug actually lies with the successful apply. The provider is designed to operate per-subscription, and the azurerm_key_vault_key resource should not have applied that in the first place. You would need to use a provider alias scoped to the subscription containing the key vault in order to use this resource.