azurerm_key_vault_managed_hardware_security_module_role_definition got error when run terraform apply "StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadParameter" Message="Invalid role definition properties"

[Komsunb]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.6.0

AzureRM Provider Version

3.90.0

Affected Resource(s)/Data Source(s)

azurerm_key_vault_managed_hardware_security_module_role_definition

Terraform Configuration Files

terraform {
    required_providers {
      azurerm = {
        source  = "hashicorp/azurerm"
        version = ">= 3.36.0"
      }
    }
    required_version = ">= 1.4.0"
  }

provider "azurerm" {
    features {
      key_vault {
        purge_soft_deleted_hardware_security_modules_on_destroy = true
      }
    }
  }
  data "azurerm_client_config" "current" {
  }
  
  resource "azurerm_resource_group" "example" {
    name     = "example-rg-hsm99"
    location = "Southeast Asia"
  }

resource "azurerm_key_vault_managed_hardware_security_module" "example" {
  name                     = "examplehsm99"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  sku_name                 = "Standard_B1"
  tenant_id                = data.azurerm_client_config.current.tenant_id
  admin_object_ids         = [data.azurerm_client_config.current.object_id]
  purge_protection_enabled = false
  soft_delete_retention_days = 7
  security_domain_key_vault_certificate_ids = ["https://test-active-hsm.vault.azure.net/certificates/cert00/c63c2752fdba4544aaddf340167631aa","https://test-active-hsm.vault.azure.net/certificates/cert01/1c912a109c354018a7a56a14395c93a4","https://test-active-hsm.vault.azure.net/certificates/cert02/9cbcb3d6766e4f039914ea5f73d35efe"]  
  security_domain_quorum = 2
}

resource "azurerm_key_vault_managed_hardware_security_module_role_definition" "example" {
  name           = "7d206142-bf01-11ed-80bc-00155d61ee9e"
  vault_base_url = azurerm_key_vault_managed_hardware_security_module.example.hsm_uri
  description    = "desc foo"
  role_name      = "MyCustomRole"
  permission {
    data_actions = [
      "Microsoft.KeyVault/managedHsm/keys/read/action",
    ]
  }
}

Debug Output/Panic Output

azurerm_key_vault_managed_hardware_security_module.example: Creation complete after 45m27s [id=/subscriptions/4d8a59e3-7895-44ae-b260-14af8bcda5dd/resourceGroups/example-rg-hsm99/providers/Microsoft.KeyVault/managedHSMs/examplehsm99]
azurerm_key_vault_managed_hardware_security_module_role_definition.example: Creating...
╷
│ Error: creating https://examplehsm99.managedhsm.azure.net///RoleDefinition/7d206142-bf01-11ed-80bc-00155d61ee9e: keyvault.RoleDefinitionsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadParameter" Message="Invalid role definition properties (Activity ID: b8f64cb4-c49f-11ee-81cb-000d3a085539)"
│ 
│   with azurerm_key_vault_managed_hardware_security_module_role_definition.example,
│   on main.tf line 39, in resource "azurerm_key_vault_managed_hardware_security_module_role_definition" "example":
│   39: resource "azurerm_key_vault_managed_hardware_security_module_role_definition" "example" {
│ 
│ creating https://examplehsm99.managedhsm.azure.net///RoleDefinition/7d206142-bf01-11ed-80bc-00155d61ee9e: keyvault.RoleDefinitionsClient#CreateOrUpdate:
│ Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadParameter"
│ Message="Invalid role definition properties (Activity ID: b8f64cb4-c49f-11ee-81cb-000d3a085539)"

Expected Behaviour

No response

Actual Behaviour

No response

Steps to Reproduce

1. terraform init
2. terraform plan
3. terraform apply

Important Factoids

No response

References

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_managed_hardware_security_module_role_definition

[wuxu92]

Hi @Komsunb , can you create the role definition in the Portal with the same parameter? It looks like a API issue as the error message is helpless.

[Komsunb]

Hi @Komsunb , can you create the role definition in the Portal with the same parameter? It looks like a API issue as the error message is helpless.

Hi @wuxu92 ,
In the Portal have not create button but I can create the role definition with Azure CLI as command below.

az keyvault role definition create --hsm-name ContosoMHSM --role-definition '{
"roleName": "My Custom Role",
"description": "The description of the custom rule.",
"actions": [],
"notActions": [],
"dataActions": [
"Microsoft.KeyVault/managedHsm/keys/read/action"
],
"notDataActions": []
}'

[Komsunb]

Hello @wuxu92
Can you test this module is work? [azurerm_key_vault_managed_hardware_security_module_role_definition]

Can you tell me for key vault hsm have terraform for create key inside key vault hsm?

[wuxu92]

@Komsunb sorry for my delay response. The API doesn't accept a null value for notDataActions field. you have to set at least one value to not_data_actions or wait this issue be fixed by #25310 .

[Komsunb]

@Komsunb sorry for my delay response. The API doesn't accept a null value for notDataActions field. you have to set at least one value to not_data_actions or wait this issue be fixed by #25310 .

@wuxu92 Thank you so much.
Can I ask one question? What's terraform module for create key inside Azure key vault managed hsm?

[wuxu92]

@Komsunb the resource for manged hsm key is still in progress with pr #25069.

[Komsunb]

@Komsunb the resource for manged hsm key is still in progress with pr #25069.

@wuxu92 Thank you so much for your help.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.