neil-yechenwei
commented
1 year ago Thanks for raising this issue. Seems I cannot repro this issue with below tf config that is similar with yours. Could you try below tf config to see if the issue still exists? If no, could you compare below tf config with yours to figure out the difference? Thanks.
provider "azurerm" {
features {
key_vault {
purge_soft_delete_on_destroy = false
purge_soft_deleted_keys_on_destroy = false
}
}
}
data "azurerm_client_config" "current" {}
resource "azurerm_resource_group" "test" {
name = "acctestRG-mysql-test0136"
location = "west europe"
}
resource "azurerm_virtual_network" "test" {
name = "acctest-vn-test0136"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
address_space = ["10.0.0.0/16"]
}
resource "azurerm_subnet" "test" {
name = "acctest-sn-test0136"
resource_group_name = azurerm_resource_group.test.name
virtual_network_name = azurerm_virtual_network.test.name
address_prefixes = ["10.0.2.0/24"]
service_endpoints = ["Microsoft.Storage"]
delegation {
name = "fs"
service_delegation {
name = "Microsoft.DBforMySQL/flexibleServers"
actions = [
"Microsoft.Network/virtualNetworks/subnets/join/action",
]
}
}
}
resource "azurerm_private_dns_zone" "test" {
name = "acctest0136.mysql.database.azure.com"
resource_group_name = azurerm_resource_group.test.name
}
resource "azurerm_private_dns_zone_virtual_network_link" "test" {
name = "acctestVnetZonetest0136.com"
private_dns_zone_name = azurerm_private_dns_zone.test.name
virtual_network_id = azurerm_virtual_network.test.id
resource_group_name = azurerm_resource_group.test.name
}
resource "azurerm_user_assigned_identity" "test" {
name = "acctestmitest0136"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
}
resource "azurerm_key_vault" "test" {
name = "acctestkvtest0136"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
tenant_id = data.azurerm_client_config.current.tenant_id
sku_name = "standard"
purge_protection_enabled = true
}
resource "azurerm_key_vault_access_policy" "server" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = azurerm_user_assigned_identity.test.principal_id
key_permissions = ["Get", "List", "WrapKey", "UnwrapKey", "GetRotationPolicy", "SetRotationPolicy"]
}
resource "azurerm_key_vault_access_policy" "client" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
key_permissions = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify", "GetRotationPolicy", "SetRotationPolicy"]
}
resource "azurerm_key_vault_key" "test" {
name = "test"
key_vault_id = azurerm_key_vault.test.id
key_type = "RSA"
key_size = 2048
key_opts = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"]
depends_on = [
azurerm_key_vault_access_policy.client,
azurerm_key_vault_access_policy.server,
]
}
resource "azurerm_mysql_flexible_server" "test" {
name = "acctest-fs-test0136"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
version = "5.7"
delegated_subnet_id = azurerm_subnet.test.id
private_dns_zone_id = azurerm_private_dns_zone.test.id
geo_redundant_backup_enabled = false
backup_retention_days = 30
administrator_login = "dbaadmin"
administrator_password = "Test##00!"
sku_name = "GP_Standard_D2ds_v4"
identity {
type = "UserAssigned"
identity_ids = [azurerm_user_assigned_identity.test.id]
}
customer_managed_key {
key_vault_key_id = azurerm_key_vault_key.test.id
primary_user_assigned_identity_id = azurerm_user_assigned_identity.test.id
}
storage {
auto_grow_enabled = false
size_gb = 20
}
lifecycle {
ignore_changes = [zone]
}
depends_on = [azurerm_private_dns_zone_virtual_network_link.test]
}
M4rkor
igor-marinho
bwilczynski
sigv
Is there an existing issue for this?
Community Note
Terraform Version
1.3.9
AzureRM Provider Version
3.46.0
Affected Resource(s)/Data Source(s)
azurerm_mysql_flexible_server
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
Object cerated.
Actual Behaviour
It fails after creation because it cannot find the keyvault with the key.
Steps to Reproduce
resource "azurerm_mysql_flexible_server" "main" { ..... identity { type = "UserAssigned" identity_ids = [var.user_assigned_identity_id] }
customer_managed_key { key_vault_key_id = var.keyvault_vault_key_id primary_user_assigned_identity_id = var.user_assigned_identity_id } ..... }
Important Factoids
No response
References
No response