azurestack_key_vault_access_policy

Manages a Key Vault Access Policy.

Example Usage

data "azurestack_client_config" "current" {}

resource "azurestack_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurestack_key_vault" "example" {
  name                = "examplekeyvault"
  location            = azurestack_resource_group.example.location
  resource_group_name = azurestack_resource_group.example.name
  tenant_id           = data.azurestack_client_config.current.tenant_id
  sku_name            = "premium"
}

resource "azurestack_key_vault_access_policy" "example" {
  key_vault_id = azurestack_key_vault.example.id
  tenant_id    = data.azurestack_client_config.current.tenant_id
  object_id    = data.azurestack_client_config.current.object_id

  key_permissions = [
    "Get",
  ]

  secret_permissions = [
    "Get",
  ]
}

Argument Reference

The following arguments are supported:

Attributes Reference

The following attributes are exported:

Timeouts

The timeouts block allows you to specify timeouts for certain actions:

Import

Key Vault Access Policies can be imported using the Resource ID of the Key Vault, plus some additional metadata.

If both an object_id and application_id are specified, then the Access Policy can be imported using the following code:

terraform import azurestack_key_vault_access_policy.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.KeyVault/vaults/test-vault/objectId/11111111-1111-1111-1111-111111111111/applicationId/22222222-2222-2222-2222-222222222222

where 11111111-1111-1111-1111-111111111111 is the object_id and 22222222-2222-2222-2222-222222222222 is the application_id.


Access Policies with an object_id but no application_id can be imported using the following command:

terraform import azurestack_key_vault_access_policy.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.KeyVault/vaults/test-vault/objectId/11111111-1111-1111-1111-111111111111

where 11111111-1111-1111-1111-111111111111 is the object_id.