Azure / Azure/aztfexport

`azurerm_key_vault_access_policy` was not exported correctly.

Open
#291 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
1.9k
Forks
221
Avg merge
15h 43m
Merged PRs (30d)
9

Description

Apply the following Terraform code:

```hcl
provider "azurerm" {
features {
key_vault {
purge_soft_delete_on_destroy = true
}
}
}

data "azurerm_client_config" "current" {}

resource "azurerm_resource_group" "example" {
name = "zjhe-aztfy-bugbash"
location = "West Europe"
}

resource "azurerm_key_vault" "example" {
name = "zjheaztfybugbash${replace(random_pet.pet.id, "-", "")}"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
enabled_for_disk_encryption = true
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
purge_protection_enabled = false

sku_name = "standard"

# access_policy {
# tenant_id = data.azurerm_client_config.current.tenant_id
# object_id = data.azurerm_client_config.current.object_id
#
# key_permissions = [
# "Get",
# ]
#
# secret_permissions = [
# "Get",
# ]
#
# storage_permissions = [
# "Get",
# ]
# }
}

resource "azurerm_key_vault_access_policy" "example" {
key_vault_id = azurerm_key_vault.example.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id

certificate_permissions = [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"SetIssuers",
"Update",
]

key_permissions = [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
]

secret_permissions = [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
]

storage_permissions = [
"Get",
"List",
"Set",
"SetSAS",
"GetSAS",
"DeleteSAS",
"Update",
"RegenerateKey"
]
}

resource "azurerm_key_vault_key" "generated" {
name = "generated-certificate"
key_vault_id = azurerm_key_vault.example.id
key_type = "RSA"
key_size = 2048

key_opts = [
"decrypt",
"encrypt",
"sign",
"unwrapKey",
"verify",
"wrapKey",
]
depends_on = [azurerm_key_vault_access_policy.example]
}

resource "azurerm_key_vault_secret" "example" {
name = "secret-sauce"
value = "szechuan"
key_vault_id = azurerm_key_vault.example.id

depends_on = [azurerm_key_vault_access_policy.example]
}

resource "random_pet" "pet" {
length = 1
}

resource "azurerm_recovery_services_vault" "vault" {
name = "zjhe-aztfy-bugbash-${random_pet.pet.id}"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
sku = "Standard"
}

resource "azurerm_storage_account" "sa" {
name = replace("zjhe-aztfy-${random_pet.pet.id}", "-", "")
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
account_tier = "Standard"
account_replication_type = "LRS"
}

resource "azurerm_backup_container_storage_account" "container" {
resource_group_name = azurerm_resource_group.example.name
recovery_vault_name = azurerm_recovery_services_vault.vault.name
storage_account_id = azurerm_storage_account.sa.id
}
```

Then try to export resource group via aztfy, the KeyVault's access policies were not exported successfully.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.