azurerm_recovery_services_vault: Error when specifying user_assigned_identity_id in the encryption block - Unexpected status 400 with error: InvalidRestApiParameter: cmkIdentity parameter is invalid. Please provide a valid cmkIdentity

[milesbarnard]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.6.5

AzureRM Provider Version

3.82.0

Affected Resource(s)/Data Source(s)

azurerm_recovery_services_vault

Terraform Configuration Files

resource "azurerm_recovery_services_vault" "rsv" {
  name                         = "rsv-myrsv-dev-uks-001"
  location                     = var.resource_group_location
  resource_group_name          = var.resource_group_name
  sku                          = "Standard"
  storage_mode_type            = "GeoRedundant"
  cross_region_restore_enabled = true
  soft_delete_enabled          = true

  encryption {
    key_id                             = module.encryption.key_id
    user_assigned_identity_id         = azurerm_user_assigned_identity.identity.id
    infrastructure_encryption_enabled  = false
  }

  identity {
    type = "UserAssigned"
    identity_ids = [
      azurerm_user_assigned_identity.identity.id
    ]
  }

  tags = var.tags
}

Debug Output/Panic Output

│ Error: updating  Vault (Subscription: "<mysubscription>"
│ Resource Group Name: "rg-base-dev-uks-001"
│ Vault Name: "rsv-terraform-dev-uks-001"): performing Update: unexpected status 400 with error: InvalidRestApiParameter: cmkIdentity parameter is invalid. Please provide a valid cmkIdentity
│ 
│   with module.subscription.module.rsv.azurerm_recovery_services_vault.rsv,
│   on terraform-modules/modules/recovery_services_vault/main.tf line 28, in resource "azurerm_recovery_services_vault" "rsv":
│   28: resource "azurerm_recovery_services_vault" "rsv" {

Expected Behaviour

It should have updated the resource to encrypt with a customer managed key with a user assigned identity to access the key vault

Actual Behaviour

It failed with an API error - unexpected status 400 with error: InvalidRestApiParameter: cmkIdentity parameter is invalid. Please provide a valid cmkIdentity

Steps to Reproduce

terraform apply

Important Factoids

No response

References

No response

[harshavmb]

Hi @milesbarnard,

Since you chose to use UserAssigned identity, in encryption block you have to specify use_system_assigned_identity to false. I know both are kind of mutually exclusive, a PR will follow to disable the above flag to false here

[milesbarnard]

@harshavmb

Thanks very much!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.