Certificate access error during Terraform plan - azure

Question

I think I'm in a bit of a chicken and egg situation, where I need to declare a certificate resource for our application gateway, but our app principal that runs Terraform in our pipeline doesn't have permissions until after applying is complete. Basically, the service principal cannot access certificates during planning, so planning never completes, and apply can't run because there is no plan file output.
Is there any way around this besides manually configuring permissions in the UI?
The access policy does include "Get" permissions for the certificate
Key Vault
resource "azurerm_key_vault" "web" {
name = lower(format("az-kv-web-%s-%s-%s", var.instance.environment, var.instance.az-region, var.instance.serial))
location = azurerm_resource_group.web.location
resource_group_name = azurerm_resource_group.web.name
sku_name = var.instance.key-vault.sku-name
# Azure AD tenant
tenant_id = var.instance.aad-tenant-id
dynamic "access_policy" {
for_each = var.instance.key-vault.access
content {
tenant_id = var.instance.aad-tenant-id
object_id = access_policy.value.object-id
certificate_permissions = access_policy.value.cert-permissions
key_permissions = access_policy.value.key-permissions
secret_permissions = access_policy.value.secret-permissions
storage_permissions = access_policy.value.storage-permissions
}
}
}
Certificate
data "azurerm_key_vault_certificate" "gateway" {
name = var.gateway.certificate-name
key_vault_id = var.key-vault.id
}
Error
╷
│ Error: reading Key Vault Certificate: keyvault.BaseClient#GetCertificate: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="The user, group or application 'appid=***;oid=***;numgroups=3;iss=https://sts.windows.net/***/' does not have certificates get permission on key vault 'az-kv-web-dev-eastus-001;location=eastus'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287" InnerError={"code":"ForbiddenByPolicy"}
│
│ with module.web["001"].module.app-gateway.data.azurerm_key_vault_certificate.gateway,
│ on modules\app-gateway\main.tf line 123, in data "azurerm_key_vault_certificate" "gateway":
│ 123: data "azurerm_key_vault_certificate" "gateway" {
│
╵

Answer 1

To create certificate and access it , I used below code:
gave terraform plan and terraform apply
code:
data "azurerm_subscription" "current" {}
resource "azuread_application" "example" {
display_name = "newexample"
// identifier_uris = ["https://kavyaexample.com"]
owners = [data.azuread_client_config.current.object_id]
sign_in_audience = "AzureADMultipleOrgs"
api {
mapped_claims_enabled = true
requested_access_token_version = 2
oauth2_permission_scope {
admin_consent_description = "Allow the application to access example on behalf of the signed-in user."
admin_consent_display_name = "Access example"
enabled = true
id = "96183846-204b-4b43-82e1-5d2222eb4b9b"
type = "User"
user_consent_description = "Allow the application to access example on your behalf."
user_consent_display_name = "Access example"
value = "user_impersonation"
}
oauth2_permission_scope {
admin_consent_description = "Administer the example application"
admin_consent_display_name = "Administer"
enabled = true
id = "be98fa3e-ab5b-4b11-83d9-04ba2b7946bc"
type = "Admin"
value = "administer"
}
}
app_role {
allowed_member_types = ["User", "Application"]
description = "Admins can manage roles and perform all task actions"
display_name = "Admin"
enabled = true
id = "1b19509b-32b1-4e9f-b71d-4992aa991967"
value = "admin"
}
app_role {
allowed_member_types = ["User"]
description = "ReadOnly roles have limited query access"
display_name = "ReadOnly"
enabled = true
id = "497406e4-012a-4267-bf18-45a1cb148a01"
value = "User"
}
feature_tags {
enterprise = true
gallery = true
}
optional_claims {
access_token {
name = "myclaim"
}
access_token {
name = "otherclaim"
}
id_token {
name = "userclaim"
source = "user"
essential = true
additional_properties = ["emit_as_roles"]
}
saml2_token {
name = "samlexample"
}
}
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
resource_access {
id = "df021288-bdef-4463-88db-98f22de89214" # User.Read.All
type = "Role"
}
resource_access {
id = "b4e74841-8e56-480b-be8b-910348b18b4c" # User.ReadWrite
type = "Scope"
}
}
required_resource_access {
resource_app_id = "c5393580-f805-4401-95e8-94b7a6ef2fc2" # Office 365 Management
resource_access {
id = "594c1fb6-4f81-4475-ae41-0c394909246c" # ActivityFeed.Read
type = "Role"
}
}
web {
homepage_url = "https://app.example.net"
logout_url = "https://app.example.net/logout"
redirect_uris = ["https://app.example.net/account"]
implicit_grant {
access_token_issuance_enabled = true
id_token_issuance_enabled = true
}
}
}
resource "azuread_service_principal" "example" {
application_id = azuread_application.example.application_id
app_role_assignment_required = false
owners = [data.azuread_client_config.current.object_id]
}
/*
resource "azurerm_role_assignment" "example" {
scope = "/subscriptions/f10a5570-53f3-473f-9c2f-bd0ee87ca71c/resourceGroups/v-sakavya-Mindtree"
role_definition_id = "b24988ac-6180-42a0-ab88-20f7382dd24c"
principal_id = azuread_service_principal.example.object_id
}
*/
resource "azurerm_key_vault" "example" {
name = "kavyaexmplkeyvault"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
enabled_for_disk_encryption = true
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
purge_protection_enabled = false
sku_name = "standard"
access_policy {
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
//object_id= azuread_service_principal.example.object_id
certificate_permissions = [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"Purge",
"SetIssuers",
"Update",
]
key_permissions = [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
]
secret_permissions = [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
]
storage_permissions = [
"Get","Set"
]
}
}
resource "tls_private_key" "example" {
algorithm = "RSA"
rsa_bits = 4096
}
resource "azurerm_key_vault_certificate" "example" {
name = "kavya-cert"
key_vault_id = azurerm_key_vault.example.id
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
lifetime_action {
action {
action_type = "AutoRenew"
}
trigger {
days_before_expiry = 30
}
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["internal.contoso.com", "domain.hello.world"]
}
subject = "CN=hello-world"
validity_in_months = 12
}
}
}
resource "azuread_application_certificate" "example" {
application_object_id = azuread_application.example.id
type = "AsymmetricX509Cert"
encoding = "hex"
value = azurerm_key_vault_certificate.example.certificate_data
//end_date = azurerm_key_vault_certificate.example.certificate_attribute[0].expires
//start_date = azurerm_key_vault_certificate.example.certificate_attribute[0].not_before
}
As the service principal got the certificate get, list , create and delete access privileges.
But when I tried removing this access policy to the service principal , I got similar error
resource "azurerm_key_vault" "example" {
name = "kavyaexmplkeyvault"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
enabled_for_disk_encryption = true
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
purge_protection_enabled = false
sku_name = "standard"
access_policy {
tenant_id = data.azurerm_client_config.current.tenant_id
// object_id = data.azurerm_client_config.current.object_id
object_id= azuread_service_principal.example.object_id
certificate_permissions = [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"Purge",
"SetIssuers",
"Update",
]
key_permissions = [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
]
secret_permissions = [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
]
storage_permissions = [
"Get","Set"
]
}
}
Error:
Status=403 Code="Forbidden" Message="The user, group or application 'appid=***;oid=***;numgroups=3;iss=https://sts.windows.net/***/' does not have certificates get permission on key vault
Then I tried to create it again with the servicepricipal giving access policies .
But still faced same error .
Then I destroyed the files but no change as it is stored in the backend and the certificate privileges cant be changes unless we have access.
Instead I have changed the keyvault name and certificate name in terraform.
Deleted the existing certificate in azure ad app.
And then created and run terraform plan and terraform apply .
Direct terraform apply also worked with the above starting code.
And it created the service principal access policies.
Certificate retrieved in azure ad application.