azurerm_api_management: custom domain key_vault_id is validated as resource id, but secret url expected

[mhennecke]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

terraform -v
Terraform v0.11.9

• provider.azurerm v1.17.0

Affected Resource(s)

• azurerm_api_management -> hostname_configuration

Expected Behavior

A custom domain with a certificate from a key vault is configured

Actual Behavior

API Management deployment fails with the following errors if either:

• key_vault_id supplied as the secret id of a certificate, e.g. /secrets/somecertname/somecertid
  Can not parse "hostname_configuration.0.proxy.0.key_vault_id" as a resource id: The number of path segments is not divisible by 2 in "/secrets/somecertname/somecertid
• key_vault_id supplied as concatenation of vault_uri and secret id, e.g. https://vaultname.vault.azure.net/secrets/somecertname/somecertid
  Can not parse "hostname_configuration.0.portal.0.key_vault_id" as a resource id: Key/Value cannot be empty strings. Key: 'https:', Value: ''

Root Cause

I assume the root cause for the issue is the validation of the key_vault_id as an Azure resource id. However, it should be treated as a URL:
https://github.com/terraform-providers/terraform-provider-azurerm/blob/271214f33d3bf487f1d8e0923d49dc258bc614a1/azurerm/resource_arm_api_management.go#L782

[tombuildsstuff]

hi @mhennecke

Just to let you know that this has been released as a part of v1.18 of the AzureRM Provider (the full changelog is available here). You can upgrade to this by specifying the version in the provider block (as shown below) and then running terraform init -upgrade

provider "azurerm" {
  version = "=1.18.0"
}

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!