terraform-provider-azurerm: Azure Key Vault resource creation fails immediately following a destroy

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or “me too” comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v1.0.0
on linux_amd64
+ provider registry.terraform.io/hashicorp/azurerm v2.64.0

Affected Resource(s)

• azurerm_key_vault_secret
• azurerm_key_vault_certificate

Terraform Configuration Files

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
    }
  }
}

provider "azurerm" {
  features {
    key_vault {
      recover_soft_deleted_key_vaults = false
      purge_soft_delete_on_destroy    = true
    }
  }
}

resource "azurerm_key_vault_secret" "secret" {
  name         = "test"
  value        = "123"
  key_vault_id = data.azurerm_key_vault.app.id
}

data "azurerm_key_vault" "app" {
  name                = "< keyvault name>"
  resource_group_name = "< keyvault RG name >"
}

Debug Output

Panic Output

Expected Behaviour

Terraform apply should re-create the resources (secrets or certificates).

Actual Behaviour

Terraform apply immediately following a destroy results in the following error:

Error: keyvault.BaseClient#RecoverDeletedSecret: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="SecretNotFound" Message="A secret with (name/id) xxxx was not found in this key vault. If you recently deleted this secret you may be able to recover it using the correct recovery command. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125182"

If the features section of the provider is updated to explictly specify:

      recover_soft_deleted_key_vaults = false
      purge_soft_delete_on_destroy    = true

the error then becomes:

azurerm_key_vault_secret.secret: Creating...
╷
│ Error: keyvault.BaseClient#SetSecret: Failure responding to request: StatusCode=409 -- Original Error: autorest/azure: Service returned an error. Status=409 Code="Conflict" Message="Secret test is currently being deleted and cannot be re-created; retry later." InnerError={"code":"ObjectIsBeingDeleted"}
│
│   with azurerm_key_vault_secret.secret,
│   on main.tf line 18, in resource "azurerm_key_vault_secret" "secret":
│   18: resource "azurerm_key_vault_secret" "secret" {

Perhaps the destroy is not waiting long enough for the correct API response from ARM? Waiting another minute or so seems to resolve this as the resource is eventually marked as deleted/purged from the key vault.

Steps to Reproduce

1. terraform apply
2. terraform destroy
3. terraform apply << Fails

Important Factoids

Reverting to v2.63.0 of azurerm does not seem to resolve this. This behavior only seemed to start occurring in the past 24 hours (19/06/2021) from what I’ve observed.

References