terraform-provider-azurerm: Failed to destroy azurerm_key_vault and associated azurerm_key_vault_access_policy (30 minute timeout)

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave “+1” or “me too” comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform = 0.12.29 azurerm = 2.48.0

Affected Resource(s)

• resource "azurerm_key_vault"
• resource "azurerm_key_vault_access_policy"

Terraform Configuration Files

resource "azurerm_key_vault" "main" {
  name                        = "keyvaultname"
  location                    = var.location
  enabled_for_disk_encryption = true
  soft_delete_retention_days  = 90
  purge_protection_enabled    = null
  tenant_id                   = data.azurerm_client_config.current.tenant_id

  sku_name = "standard"

  network_acls {
    default_action = "Allow"
    bypass         = "AzureServices"
  }
}

resource "azurerm_key_vault_access_policy" "kv_readers_policy" {
  key_vault_id = azurerm_key_vault.main.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azuread_group.key_vault_readers.id

  key_permissions = [
    "get",
    "list"
  ]

  secret_permissions = [
    "get",
    "list"
  ]

  storage_permissions = [
    "get",
    "list"
  ]

  certificate_permissions = [
    "get",
    "getissuers",
    "list",
    "listissuers"
  ]
}

Debug Output

Panic Output

Expected Behavior

When destroying a Key Vault the associated Key Vault Access Policies are destroyed as well.

Actual Behavior

When destroying a Key Vault the (de)provisioning process fails after 30 minutes.

Error: failed waiting for Key Vault Access Policy (Object ID: "XXXXXXXXXXXXXXXXXXXXXXXX") to apply: timeout while waiting for state to become 'notfound' (last state: 'found', timeout: 30m0s)

Error: Error updating Access Policy (Object ID "XXXXXXXXXXXXXXXXXXXXXXXX" / Application ID "") for Key Vault "key_vault_name" (Resource Group "resource_group_name"): keyvault.VaultsClient#UpdateAccessPolicy: Failure sending request: StatusCode=0 -- Original Error: context deadline exceeded

Steps to Reproduce

1. terraform destroy

Important Factoids

This issue appears to be relatively new. The destroy process on the Key Vault and associated Key Vault Access Policies worked with the following Terraform and Azurerm versions…

Terraform = 0.12.29 azurerm = 2.46.0

References

• #0000