azurerm_mysql_flexible_server internal server error with geo_redundant_backup and customer managed key

[andreipantelimon]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

1.0.9

AzureRM Provider Version

3.41.0

Affected Resource(s)/Data Source(s)

azurerm_mysql_flexbile_server

Terraform Configuration Files

resource "azurerm_mysql_flexible_server" "server" {
  name                   = var.sqlserver_name
  resource_group_name    = var.rg_name
  location               = var.location
  version                = var.sqlserver_version
  administrator_login    = var.administrator_sql_login
  administrator_password = var.administrator_sql_password
  sku_name               = var.sku_name
  geo_redundant_backup_enabled = true
  backup_retention_days        = 7

  customer_managed_key {
    key_vault_key_id                  = var.key_vault_key_id
    primary_user_assigned_identity_id = var.primary_user_assigned_identity_id
  }
}

Debug Output/Panic Output

Error: creating Flexible Server (Subscription: "$SUB_ID"
Resource Group Name: "$RG_NAME"
Flexible Server Name: "$SERVER_NAME"): polling after Create: Code="InternalServerError" Message="An unexpected error occured while processing the request. Tracking ID: '$TRACKING_ID'"

  with module.mysql-flexible-server.azurerm_mysql_flexible_server.server,
  on ../../modules/mysql-flexible-server/main.tf line 39, in resource "azurerm_mysql_flexible_server" "server":
  39: resource "azurerm_mysql_flexible_server" "server" {

Expected Behaviour

When provided a customer managed key for data encryption, terraform provider should put the same key or offer the option to select another key for the geo-redundant-backup server. Currently, the geo-redundant server does not get any CMK and a conflict appears, as from the Microsoft's official answer.

Actual Behaviour

The same CMK should have been provided to the geo-redundant backup server as well.

Steps to Reproduce

terraform apply with both options enabled (geo_redundant_backup_enabled and customer_managed_key block)

Important Factoids

No

References

No response

[neil-yechenwei]

Thanks for raising this issue. When geoRedundantBackup is enabled and CMK is set, geoBackupKeyURI and geoBackupUserAssignedIdentityId also need to be set. But unfortunately, these two properties haven't been supported by TF for now.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.