Facing Terraform KeyVault Certificates creation issue - terraform

Question

hello everyone I am facing issue I have a script in which I am creating resource group and key vault and I copied the credentials from central KV into new one when I create RG and Key vault alone and then add Credentials copy portion into the script everything gets created but when I combine the code where 1 RG and 1 KV along with the credentials copy happens it says the Error Key vault in RG is does not exist. I am asking that is there any sequence in terraform do I need to follow ?
Resource.tf
resource "azurerm_resource_group" "main" {
name = "${var.prefix}-resourceGB"
location = var.location
}
# --- Get reference to logged on Azure subscription ---
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "New" {
name = "KV1"
location = azurerm_resource_group.main.location
resource_group_name = azurerm_resource_group.main.name
enabled_for_disk_encryption = true
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_enabled = true
purge_protection_enabled = false
sku_name = "standard"
access_policy {
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
certificate_permissions = [
"create",
"delete",
"deleteissuers",
"get",
"getissuers",
"import",
"purge",
"list",
"listissuers",
"managecontacts",
"manageissuers",
"setissuers",
"update",
]
key_permissions = [
"backup",
"create",
"decrypt",
"delete",
"encrypt",
"get",
"import",
"list",
"purge",
"recover",
"restore",
"sign",
"unwrapKey",
"update",
"verify",
"wrapKey",
]
secret_permissions = [
"backup",
"delete",
"get",
"list",
"purge",
"recover",
"restore",
"set",
]
}
}
data "azurerm_key_vault" "existing" {
name = "Old-KV"
resource_group_name = "Old-RG"
}
data "azurerm_key_vault" "New" {
name = "KV1"
resource_group_name = "${var.prefix}-resourceGB"
}
module "Cert1" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert1"
destination_key_vault_id = data.azurerm_key_vault.New.id
destination_key_vault_cert_name = "Cert1"
}
module "Cert2" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert2"
destination_key_vault_id = data.azurerm_key_vault.New.id
destination_key_vault_cert_name = "Cert2"
}
Copy Cert main.tf
data "azurerm_key_vault_secret" "source_KV_cert" {
name = var.source_key_vault_cert_name
key_vault_id = var.source_key_vault_id
}
data "azurerm_key_vault_certificate" "source_cert" {
name = var.source_key_vault_cert_name
key_vault_id = var.source_key_vault_id
}
resource "azurerm_key_vault_certificate" "dest_cert" {
name = var.destination_key_vault_cert_name
key_vault_id = var.destination_key_vault_id
certificate {
contents = data.azurerm_key_vault_secret.source_KV_cert.value
}
certificate_policy {
issuer_parameters {
name = "self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
secret_properties {
content_type = "application/x-pkcs12"
}
}
}
Copy Cert Variable.tf
variable "source_key_vault_id" {
type = string
}
variable "source_key_vault_cert_name" {
type = string
}
variable "destination_key_vault_id" {
type = string
}
variable "destination_key_vault_cert_name" {
type = string
}

Answer 1

Since you are creating a new key vault with resource "azurerm_key_vault", you can't use the data source to query for a new resource that is creating at that time in your modules module "Cert1" and module "Cert2" in the same .tf file. The data "azurerm_key_vault" is used to access information about an existing Key Vault.
So change the related code in the file Resource.tf like this:
# data "azurerm_key_vault" "New" {
# name = "KV1"
# resource_group_name = "${var.prefix}-resourceGB"
# }
module "Cert1" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert1"
destination_key_vault_id = azurerm_key_vault.New.id # changed
destination_key_vault_cert_name = "Cert1"
}
module "Cert2" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert2"
destination_key_vault_id = azurerm_key_vault.New.id # changed
destination_key_vault_cert_name = "Cert2"
}