azurerm_storage_account_customer_managed_key fails with managed hsm id

[dano0b]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

  source  = "hashicorp/azurerm"
  version = "~> 2.76.0"

Affected Resource(s)

• azurerm_storage_account_customer_managed_key

Terraform Configuration Files

resource "azurerm_storage_account_customer_managed_key" "this" {
  storage_account_id = azurerm_storage_account.this.id
  key_vault_id       = var.azurerm_storage_account_customer_managed_key_key_vault_id
  key_name           = var.azurerm_storage_account_customer_managed_key_key_name
}

Debug Output

Panic Output

Expected Behaviour

By providing a managed HSM ID like "/subscriptions/.../resourceGroups/.../providers/Microsoft.KeyVault/managedHSMs/YOURHSM" it should setup the encryption similar to:
az storage account update --name ... --resource-group ... --encryption-key-name ... --encryption-key-source Microsoft.Keyvault --encryption-key-vault $YOURHSMURL --subscription ...

Actual Behaviour

│ Error: ID was missing the `vaults` element
│ 
│   with module.storagecontainer.azurerm_storage_account_customer_managed_key.this,
│   on .terraform/modules/storagecontainer/main.tf line 65, in resource "azurerm_storage_account_customer_managed_key" "this":
│   65:   key_vault_id       = var.azurerm_storage_account_customer_managed_key_key_vault_id

This happens it checks just for classic KeyVaults via:
https://github.com/hashicorp/terraform-provider-azurerm/blob/main/internal/services/keyvault/parse/vault.go#L60
while:
https://github.com/hashicorp/terraform-provider-azurerm/blob/main/internal/services/keyvault/parse/managed_hsm.go#L60
should be respected too.

Was first thinking to open a feature request but since both are KeyVaults I think it is more a bug.

Steps to Reproduce

1. Use HSM ID as key_vault_id in azurerm_storage_account_customer_managed_key.
2. test it

Important Factoids

References

• Support for creating keys in a managed HSM #13654 not directly related but it seems the provider is slow with the managed HSM adoption

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.