Circular dependency issue in ARM template for Cosmos DB with encryption - azure

Question

I want to create an ARM template for encrypted CosmosDB by customer managed key
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
...
},
"functions": [],
"variables": {
...
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2020-04-01-preview",
"name": "[variables('keyVaultName')]",
"location": "westeurope",
"properties": {
"sku": {
"family": "A",
"name": "Standard"
},
"tenantId": "[parameters('tenantId')]",
"dependsOn": [
"[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName'))]"
],
"accessPolicies": [
{
"tenantId": "[parameters('tenantId')]",
"objectId": "[reference(resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName')), '2021-03-01-preview', 'full').identity.principalId]",
"permissions": {
"keys": [
"get",
"wrapKey",
"unwrapKey"
]
}
}
],
"enabledForDeployment": false,
"enabledForDiskEncryption": false,
"enabledForTemplateDeployment": false,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 90,
"enableRbacAuthorization": false,
"vaultUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/')]",
"provisioningState": "Succeeded",
"enablePurgeProtection": true
}
},
{
"type": "Microsoft.KeyVault/vaults/keys",
"apiVersion": "2020-04-01-preview",
"name": "[concat(variables('keyVaultName'), '/', variables('keyVaultName'), '-cosmos-db')]",
"location": "westeurope",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]"
],
"properties": {
"crv": "P-256",
"kty": "EC",
"key_size": 4096,
"keyOps": [
"wrapKey",
"unwrapKey"
],
"attributes": {
"enabled": true
}
}
},
{
"type": "Microsoft.DocumentDB/databaseAccounts",
"name": "[variables('dbAccountName')]",
"apiVersion": "2021-01-15",
"location": "[parameters('location')]",
"kind": "MongoDB",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]",
"locations": "[variables('locations')]",
"databaseAccountOfferType": "Standard",
"apiProperties": {
"serverVersion": "[parameters('serverVersion')]"
},
"keyVaultKeyUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/keys/', variables('keyVaultName'), '-cosmos-db')]"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', variables('keyVaultName'), concat(variables('keyVaultName'), '-cosmos-db'))]"
]
}
],
"outputs": {
...
}
}
I was trying approach with nested template but getting such error after deployment: "DatabaseAccount name '****' already exists"
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
...
},
"functions": [],
"variables": {
...
},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2020-04-01-preview",
"name": "[variables('keyVaultName')]",
"location": "westeurope",
"properties": {
"sku": {
"family": "A",
"name": "Standard"
},
"tenantId": "[parameters('tenantId')]",
"dependsOn": [
"[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName'))]",
"[resourceId('Microsoft.Web/sites', variables('appName'))]"
],
"accessPolicies": [
{
"tenantId": "[parameters('tenantId')]",
"objectId": "[reference(resourceId('Microsoft.DocumentDB/databaseAccounts', variables('dbAccountName')), '2021-03-01-preview', 'full').identity.principalId]",
// "objectId": "d8749310-a50e-457e-97cb-c6e8ea601eb9",
"permissions": {
"keys": [
"get",
"wrapKey",
"unwrapKey"
]
}
}
],
"enabledForDeployment": false,
"enabledForDiskEncryption": false,
"enabledForTemplateDeployment": false,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 90,
"enableRbacAuthorization": false,
"vaultUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/')]",
"provisioningState": "Succeeded",
"enablePurgeProtection": true
}
},
{
"type": "Microsoft.KeyVault/vaults/keys",
"apiVersion": "2020-04-01-preview",
"name": "[concat(variables('keyVaultName'), '/', variables('keyVaultName'), '-cosmos-db')]",
"location": "westeurope",
// "dependsOn": [
// "[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]"
// ],
"properties": {
"crv": "P-256",
"kty": "EC",
"key_size": 4096,
"keyOps": [
"wrapKey",
"unwrapKey"
],
"attributes": {
"enabled": true
}
}
},
{
"type": "Microsoft.DocumentDB/databaseAccounts",
"name": "[variables('dbAccountName')]",
"apiVersion": "2021-01-15",
"location": "[parameters('location')]",
"kind": "MongoDB",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]",
"locations": "[variables('locations')]",
"databaseAccountOfferType": "Standard",
"apiProperties": {
"serverVersion": "[parameters('serverVersion')]"
}
// "keyVaultKeyUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/keys/', variables('keyVaultName'), '-cosmos-db')]"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', variables('keyVaultName'), concat(variables('keyVaultName'), '-cosmos-db'))]"
]
},
{
"type": "Microsoft.Resources/deployments",
"apiVersion": "2020-10-01",
"name": "databaseUpdate",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults/keys', variables('keyVaultName'), concat(variables('keyVaultName'), '-cosmos-db'))]"
],
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.DocumentDB/databaseAccounts",
"name": "[variables('dbAccountName')]",
"apiVersion": "2021-01-15",
"location": "[parameters('location')]",
"kind": "MongoDB",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"consistencyPolicy": "[variables('consistencyPolicy')[parameters('defaultConsistencyLevel')]]",
"locations": "[variables('locations')]",
"databaseAccountOfferType": "Standard",
"apiProperties": {
"serverVersion": "[parameters('serverVersion')]"
},
"keyVaultKeyUri": "[concat('https://', variables('keyVaultName'), '.vault.azure.net/keys/', variables('keyVaultName'), '-cosmos-db')]"
}
},
{
"type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
"name": "[concat(variables('dbAccountName'), '/', variables('dbName'))]",
"apiVersion": "2021-01-15",
"dependsOn": [
"[resourceId('Microsoft.DocumentDB/databaseAccounts/', variables('dbAccountName'))]"
],
"properties": {
"resource": {
"id": "[variables('dbName')]"
},
"options": {
"throughput": "[parameters('throughput')]"
}
}
}
]
}
}
}
],
"outputs": {
...
}
}
I was also trying to create key vault resource and key vault access policy separately. But getting exception
{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"BadRequest","message":"Access policies operation not permitted. Allowed operations are "add", "replace", and "remove"."}]}