Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Terraform's Key Vault updating error (blocking the deploy-dev.yaml workflow from completing) #520

Open
derekadombek opened this issue Jan 16, 2025 · 0 comments

Comments

@derekadombek
Copy link
Collaborator

derekadombek commented Jan 16, 2025

When applying Terraform especially an environment updating change, everything gets applied successfully except for when Key Vault tries to update the DB password and then it fails with an error message like this:
Image
This is valid because we do not want to update the db password but we still need Terraform Apply to end successfully because this causes Github Actions workflows to fail.

I have gotten Terraform Apply to end successfully by adding this feature to the azurerm provider:

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }
}

and changing the purge_protection_enabled option to true in the Key Vault module, but this will create a new password. We ran out of time to test and make sure this doesn't break anything but from what I noticed the db was still able to read from the older password(I think because the recover_soft_deleted_key_vaults option is enabled?)

Acceptance Criteria
Either somehow turn this error into a warning to keep Terraform from failing, verify the soft purge option is a solid fix for this, or use a better way to work around the persistence of this Key Vault secret.

Additional context

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant