Unable to destroy: azurerm_key_vault_access_policy

[joselcaguilar]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.14.7

• provider registry.terraform.io/hashicorp/azurerm v2.49.0

Affected Resource(s)

• azurerm_key_vault_access_policy (access_policy block has not been added into azurerm_key_vault.akv parent resource following the best practice described here)

Terraform Configuration Files

resource "azurerm_key_vault_access_policy" "accessPolicies" {
  count        = length(var.accessPolicies)
  key_vault_id = azurerm_key_vault.akv.id

  tenant_id = var.tenantId
  object_id = var.accessPolicies[count.index].objectId

  key_permissions         = var.accessPolicies[count.index].keyPermissions
  secret_permissions      = var.accessPolicies[count.index].secretPermissions
  certificate_permissions = var.accessPolicies[count.index].certificatePermissions
  storage_permissions     = var.accessPolicies[count.index].storagePermissions
}

Debug Output

etsas","update"]}}],"enabledForDeployment":false,"enabledForDiskEncryption":false,"enabledForTemplateDeployment":false,"enableSoftDelete":true,"enableRbacAuthorization":false,"vaultUri":"https://**[HIDDEN]**.vault.azure.net/","provisioningState":"Succeeded"}}
module.umi.azurerm_key_vault_access_policy.umi[0]: Still destroying... [id=/subscriptions/**[HIDDEN]**-...d/**[HIDDEN]**, 20m0s elapsed]
2021-02-26T12:05:13.567Z [WARN]  plugin.terraform-provider-azurerm_v2.49.0_x5: [WARN] WaitForState timeout after 20m0s
2021-02-26T12:05:13.567Z [WARN]  plugin.terraform-provider-azurerm_v2.49.0_x5: [WARN] WaitForState starting 30s refresh grace period
2021-02-26T12:05:13.567Z [DEBUG] plugin.terraform-provider-azurerm_v2.49.0_x5: [DEBUG] Unlocking "azurerm_key_vault.**[HIDDEN]**"
2021-02-26T12:05:13.567Z [DEBUG] plugin.terraform-provider-azurerm_v2.49.0_x5: [DEBUG] Unlocked "azurerm_key_vault.**[HIDDEN]**"
2021/02/26 12:05:13 [DEBUG] module.umi.azurerm_key_vault_access_policy.umi[0]: apply errored, but we're indicating that via the Error pointer rather than returning it: failed waiting for Key Vault Access Policy (Object ID: "**[HIDDEN]**") to apply: timeout while waiting for state to become 'notfound' (last state: 'found', timeout: 20m0s)
2021/02/26 12:05:13 [WARN] Log levels other than TRACE are currently unreliable, and are supported only for backward compatibility.
  Use TF_LOG=TRACE to see Terraform's internal logs.
  ----
2021/02/26 12:05:13 [DEBUG] Azure Backend Request: 
HEAD /umi/umi.tfstate HTTP/1.1
Host: **[HIDDEN]**.blob.core.windows.net
User-Agent: Terraform/0.14.7 VSTS_**[HIDDEN]**_build_11206_0
X-Ms-Date: Fri, 26 Feb 2021 12:05:13 GMT
X-Ms-Lease-Id: **[HIDDEN]**
X-Ms-Version: 2018-11-09

Panic Output

Expected Behaviour

Successful destroy in Azure Key Vault access policies

Actual Behaviour

Destroy step is failing with:
Error: failed waiting for Key Vault Access Policy (Object ID: "**[HIDDEN]**") to apply: timeout while waiting for state to become 'notfound' (last state: 'found', timeout: 20m0s)

Steps to Reproduce

1. terraform destroy

Important Factoids

References

Maybe could be related to the recent change implemented on #10577 or #10695

[tombuildsstuff]

hi @joselcaguilar

Thanks for opening this issue :)

Taking a look through this appears to be a duplicate of #10707 - rather than having multiple issues open tracking the same thing I'm going to close this issue in favour of that one; would you mind subscribing to #10707 for updates?

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!