Destroy on an azurerm_key_vault_access_policy resource waits until it times out

[giacomo-pati]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.14.7

• provider registry.terraform.io/hashicorp/azurerm v2.49.0

Affected Resource(s)

• azurerm_key_vault_access_policy

Terraform Configuration Files

terraform {
  required_version = "=0.14.7"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.49.0"
    }
  }
}

provider "azurerm" {
  use_msi         = var.useMSI
  subscription_id = var.subscriptionId
  tenant_id       = var.tenantId
  features {}
}

resource "azurerm_key_vault" "akv" {
  name                = var.kvName
  location            = var.location
  resource_group_name = var.resourceGroup
  tenant_id           = var.tenantId
  sku_name            = "standard"
}

resource "azurerm_key_vault_access_policy" "accessPolicies" {
  key_vault_id = azurerm_key_vault.akv.id
  tenant_id               = var.tenantId
  object_id               = var.ownerObjectId
  key_permissions         = []
  secret_permissions      = ["backup", "delete", "get", "list", "purge", "recover", "restore", "set"]
  certificate_permissions = []
  storage_permissions     = []
}

resource "random_password" "admin_password" {
  length = 32
}

resource "azurerm_key_vault_secret" "admin_secret" {
  name         = "admin"
  value        = random_password.admin_password.result
  key_vault_id = azurerm_key_vault.akv.id
  depends_on = [
    azurerm_key_vault_access_policy.accessPolicies
  ]
}

Debug Output

Panic Output

Expected Behaviour

The access policy should be destroyed

Actual Behaviour

terraform destroy times out after ~20' with:

Error: failed waiting for Key Vault Access Policy (Object ID: "...") to apply: timeout while waiting for state to become 'notfound' (last state: 'found', timeout: 20m0s)

Steps to Reproduce

1. terraform apply
2. terraform destroy

Important Factoids

azurerm version 2.48.0 had the deletion issue which should have been fixed with #10577, but now the issue is different (or related to #10577?)

References

• #0000

[tombuildsstuff]

hi @giacomo-pati

Thanks for opening this issue :)

Taking a look through this appears to be a duplicate of #10707 - rather than having multiple issues open tracking the same thing I'm going to close this issue in favour of that one; would you mind subscribing to #10707 for updates?

Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!