Open thatdotnetguy opened 3 months ago
I can replicate this on v3.106.1.
Worth noting that in the state, RBAC is set to false regardless of the enable_rbac_authorization
setting:
❯ terraform state show module.keyvault.azurerm_key_vault.main
# module.keyvault.azurerm_key_vault.main:
resource "azurerm_key_vault" "main" {
access_policy = []
enable_rbac_authorization = false # <------
enabled_for_deployment = false
enabled_for_disk_encryption = false
...snip...
Okay, so turns out my problem was that while I had Owner permission on the created KeyVault, inherited from the subscription, I had a role constraint that prevented me from changing the KeyVault to RBAC.
Removing the 'Role Based Access Control Administration' constraint on the Owner role allowed me to create the Key Vault via Terraform with RBAC enabled.
Looks like when this constraint is present it silently prevents you from setting RBAC via TF - it does error if you attempt to switch it via the Portal, though.
I encountered the same issue. But my case was that I had had a Key Vault with the same name before and when I applied Terraform, it simply recovered the key vault. So I had to disable this auto-recovery feature. I spent total four hours before finally realising that :(
The document is here: azurerm_key_vault
Is there an existing issue for this?
Community Note
Terraform Version
1.8.3
AzureRM Provider Version
3.100.0
Affected Resource(s)/Data Source(s)
azurerm_key_vault
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
In portal --> created key vault --> Access configuration should be set to "Azure role-based access control (recommended"
Actual Behaviour
Vault access policy is set instead
Steps to Reproduce
resource "azurerm_key_vault" "keyvault" { name = var.name location = var.location resource_group_name = var.resource_group_name tenant_id = var.tenant_id public_network_access_enabled = false enable_rbac_authorization = true soft_delete_retention_days = 7 purge_protection_enabled = false sku_name = "standard" }
Important Factoids
No
References
No