Azure Terraform log out and back to recognize permissions - terraform

Question

I have a Terraform configuration for an Azure Key Vault:
resource "azurerm_key_vault" "key_vault" {
# ...
network_acls {
default_action = "Deny"
ip_rules = ["MY_IP_ADDRESS"]
bypass = "AzureServices"
}
}
resource "azurerm_key_vault_access_policy" "application" {
key_vault_id = azurerm_key_vault.key_vault.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
certificate_permissions = local.permissions_certificates_all
key_permissions = local.permissions_keys_all
secret_permissions = local.permissions_secrets_all
storage_permissions = local.permissions_storage_all
}
What happens is that when I attempt to add an azurerm_key_vault_secret to the Key Vault that is created above, it fails with the error message:
Service returned an error. Status=403 Code="Forbidden" Message="The user, group or application 'appid=ID;oid=ID;iss=https://sts.windows.net/ID/' does not have secrets get permission on key vault 'KEY_VAULT_NAME;location=eastus2'
When I run the terraform apply again, it works just fine.
I tried adding a time_sleep with 10 minutes (and a set of depends_on needs to ensure it happens) to see if it would resolve it, and it did not.
It seems, however, that the solution is to somehow request that Terraform re-authenticate in some way so that the permissions get picked up.
Is there a way to do this in a Terraform file with the azurerm provider or generically request re-authentication? I did not see it in the documentation.
Thanks!
Terraform Version Data:
Terraform v1.1.2
on linux_amd64
+ provider registry.terraform.io/hashicorp/azuread v2.13.0
+ provider registry.terraform.io/hashicorp/azurerm v2.90.0
+ provider registry.terraform.io/hashicorp/random v3.1.0
+ provider registry.terraform.io/microsoft/azuredevops v0.1.8

Answer 1

Did you try seeing what happens when you explicitly state the permissions?
In your case as a starting point just get:
resource "azurerm_key_vault_access_policy" "application" {
key_vault_id = azurerm_key_vault.key_vault.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
certificate_permissions = local.permissions_certificates_all
key_permissions = local.permissions_keys_all
storage_permissions = local.permissions_storage_all
secret_permissions = [
"Get",
]
}

Answer 2

It's a timing issue. Terraform applies in parallel threads, so it is trying to add the secret before the policy is added. That is why it works the second time.
To avoid this, you can add a
depends_on = [azurerm_key_vault_access_policy.application]
to your secret.
This will make the secret creation wait until the policy is added.