azurerm_postgresql_flexible_server: support for Key Vault Keys from a Managed HSM

[LinierCorp]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.2.6

AzureRM Provider Version

3.107

Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server

Terraform Configuration Files

resource "azurerm_postgresql_flexible_server" "example" {
  name                          = "example-psqlflexibleserver"
  resource_group_name           = "resource-group"
  location                      = "location"
  version                       = "12"
  public_network_access_enabled = true
  administrator_login           = "psqladmin"
  administrator_password        = "***********"
  zone                          = "1"

  storage_mb   = 32768
  storage_tier = "P30"

  sku_name   = "GP_Standard_D4s_v3"

  identity {
    type         = "UserAssigned"
    identity_ids = ["USER_ASSIGNED_IDENTITY_ID"]
  }

  customer_managed_key {
      key_vault_key_id = "https://XXX.managedhsm.azure.net/keys/KEY_NAME/KEY_VERSION"
      primary_user_assigned_identity_id = "USER_ASSIGNED_IDENTITY_ID"
  }
}

Debug Output/Panic Output

Error: parsing "https://XXX.managedhsm.azure.net/keys/KEY_NAME/KEY_VERSION": internal-error: Managed HSM IDs are not supported as Key Vault Nested Items

Expected Behaviour

• The parameter key_vault_key_id should accept a value with ".managedhsm."
  or
• The parameter managed_hsm_key_id should be added

Actual Behaviour

Terraform throw an error:
Error: parsing "https://XXX.managedhsm.azure.net/keys/KEY_NAME/KEY_VERSION": internal-error: Managed HSM IDs are not supported as Key Vault Nested Items

Steps to Reproduce

1. terraform plan

Important Factoids

No response

References

• Same issue here with azurerm_mssql_server : `azurerm_mssql_server_transparent_data_encryption: support for Key Vault Keys from a Managed HSM #22977
• Same issue here with disk_encryption_set : disk_encryption_set doesn't support referencing a key in a managed HSM key vault in the key_vault_key_id #21470

I found this error message in this function : https://github.com/hashicorp/terraform-provider-azurerm/blob/main/internal/services/keyvault/parse/nested_item.go#L121

[ErikSchutte]

Hitting this same issue on AzureRM version 4.7.0, neither the id nor versioned_id are supported yet.

When selected via the portal this works seamlessly.

Any idea when this will be integrated?