Key Vault: Cannot add azurerm_key_vault contacts when using azurerm_key_vault_access_policy

[mark-greene]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.1.9

AzureRM Provider Version

3.4.0

Affected Resource(s)/Data Source(s)

azurerm_key_vault

Terraform Configuration Files

data "azurerm_client_config" "current" {}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_key_vault" "example" {
  name                = "examplekeyvault"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "premium"

  contact {
      email = "example.name@example.com"
  }
}

resource "azurerm_key_vault_access_policy" "example" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  certificate_permissions = [
    "ManageContacts",
  ]
}

Debug Output/Panic Output

│ Error: failed to set Contacts for Vault: (Name "examplekeyvault" / Resource Group "example-resources"): keyvault.BaseClient#SetCertificateContacts: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="The user, group or application 'appid=***;oid=***;numgroups=1;iss=https://sts.windows.net/***/' does not have certificates managecontacts permission on key vault 'examplekeyvault;location=westeurope'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287" InnerError={"code":"AccessDenied"}

Expected Behaviour

There needs to be a new resource for contacts, "azurerm_key_vault_contacts" so that contacts can be added when using "azurerm_key_vault_access_policy".

Actual Behaviour

No response

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[myc2h6o]

Hi @mark-greene maybe you can try the inline access_policy

resource "azurerm_key_vault" "example" {
  name                = "examplekeyvault"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "premium"

  contact {
      email = "example.name@example.com"
  }

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

    certificate_permissions = [
        "ManageContacts",
    ]
  }
}

[mark-greene]

Yes, inline will work but not if you have multiple policies and must use azurerm_key_vault_access_policy. They do not work together and inline will remove all your other policies (as I found out in my testing). I currently have 5 policies and need to be able to add more. I also need to be notified when certificates expire / rotate and must use "contact".

[myc2h6o]

Hi @mark-greene I see. After looking at the existing issues, I found an existing feature request #10256 to add the support for this. Would you mind subscribing to it for the update? I'll pick up the change from the closed pr mentioned in that issue.

[joshwright10]

I found that using inline is working workaround, just as long as you don't have more than 16 policies.
This works for me:

resource "azurerm_key_vault" "sub01" {
  # .... omitted config ... #

  contact {
    email = "sslcertificatemanagers@example.com"
  }

  access_policy = [
    {
      # Current Service Principal
      tenant_id      = data.azurerm_client_config.current.tenant_id
      object_id      = data.azurerm_client_config.current.object_id
      application_id = null
      certificate_permissions = ["ManageContacts"]
      key_permissions         = []
      secret_permissions      = []
      storage_permissions     = []
    },
    {
      tenant_id = data.azurerm_client_config.current.tenant_id
      object_id = "c9d500db-7d3e-4b80-954f-454099a138be" # DevOpsTeam
      application_id = null
      certificate_permissions = ["Get", "List"]
      key_permissions = ["List"]
      secret_permissions = ["List"]
      storage_permissions = ["Get", "List"]
    }
  ]
}

I found that it fails if you don't specify everything, even if it is null. Also mentioned here: #11728

[myc2h6o]

@mark-greene I've created #19743 to add the support for this. You can find more details in #10256

[myc2h6o]

@joshwright10 The inline option now supports 1024 as well:

terraform-provider-azurerm/internal/services/keyvault/key_vault_resource.go

Lines 94 to 99 in 5c310f0

	"access_policy": {
	Type: pluginsdk.TypeList,
	ConfigMode: pluginsdk.SchemaConfigModeAttr,
	Optional: true,
	Computed: true,
	MaxItems: 1024,

The document of azurerm_key_vault was not updated correctly in #2866 when updating the limit from 16 to 1024, it only updated the document for azurerm_key_vault_access_policy, I've opened #19753 to fix the document.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.