azurerm_key_vault_access_policy casing is

[FernandoMiguel]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Affected Resource(s)

Terraform v0.14.6

• provider registry.terraform.io/hashicorp/azuread v1.3.0
• provider registry.terraform.io/hashicorp/azurerm v2.46.1
• provider registry.terraform.io/hashicorp/random v3.0.1
• provider registry.terraform.io/hashicorp/time v0.6.0
• provider registry.terraform.io/microsoft/azuredevops v0.1.2

Terraform Configuration Files

resource "azurerm_key_vault_access_policy" "owners" {
  object_id    = local.azuread_application_owners
  key_vault_id = azurerm_key_vault.key_vault.id
  tenant_id    = data.azurerm_client_config.azurerm_client_config.tenant_id

  key_permissions = [
    "Get",
    "List",
    # "Update",
    # "Create",
    # "Import",
    # "Delete",
    # "Recover",
    # "Backup",
    # "Restore",
    # "Decrypt",
    # "Encrypt",
    # "UnwrapKey",
    # "WrapKey",
    # "Verify",
    # "Sign",
    # "Purge",
  ]

  secret_permissions = [
    "Get",
    "List",
    "Set",
    "Delete",
    "Recover",
    "Backup",
    "Restore",
    "Purge",
  ]

  storage_permissions = [
    "get",
    "list",
  ]

  certificate_permissions = [
    "Get",
    "List",
  ]
}

Debug Output

          ~ {
              ~ key_permissions         = [
                  - "get",
                  - "list",
                  + "Get",
                  + "List",
                ]
              ~ secret_permissions      = [
                  - "get",
                  - "list",
                  + "Get",
                  + "List",
                ]
                # (5 unchanged elements hidden)
            },
          ~ {
              ~ key_permissions         = [
                  - "get",
                  - "list",
                  + "Get",
                  + "List",
                ]
              ~ secret_permissions      = [
                  - "get",
                  - "list",
                  + "Get",
                  + "List",
                ]
                # (5 unchanged elements hidden)
            },

Expected Behaviour

Documentation says all args are lower case, but seems the API returns camel case .

But worse, storage_permissions only takes lower case

Error: expected storage_permissions.0 to be one of [backup delete deletesas get getsas list listsas purge recover regeneratekey restore set setsas update], got Get

Actual Behaviour

Steps to Reproduce

1. terraform apply

References

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy

[ghost]

This has been released in version 2.48.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.48.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!