Support for versionless key vault secretId in azurerm_application_gateway

[r-t-m]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The v2.2.0 version added support for key_vault_secret_id in azurerm_application_gateway (huge thanks for that!) but validate function requires the secret to be specified with a version. Is it possible to loose that requirement and make a secret version optional so that application gateway would fetch newer cerificate when its available? Powershell and az support such scenario with versionless secret id.

New or Affected Resource(s)

*azurerm_application_gateway

Potential Terraform Configuration

...
  ssl_certificate {
    name                = "wildcard"
    key_vault_secret_id = "https://{keyvault-name}.vault.azure.net/secrets/wildcard-certificate
  }
...

Actual Behavior

Error: Error parsing Key Vault Child ID: Azure KeyVault Child Id should have 3 segments, got 2: 'secrets/wildcard-certificate'

  on application_gateway.tf line 89, in resource "azurerm_application_gateway" "this":
 89: resource "azurerm_application_gateway" "this" {

References

• #0000

[francescopersico]

@katbyte is there a Validator for a secret_id without the version?

[swes1110]

Looks to me like the Azure API for application gateway's doesn't allow you to select a key vault certificate any way other than the secret identifier. Have you tried using a key vault data source like this? (code may not be perfect, haven't tested it)

# Get Key Vault ID
data "azurerm_key_vault" "keyVault" {
  name = "{keyVaultName}"
  resource_group_name = "{keyVaultResourceGroupName}"
}

# Get ID for latest certificate version in KV
data "azurerm_key_vault_secret" "certificate" {
    name = "{keyVaultCertificateName}"
    key_vault_id = data.azurerm_key_vault.keyVault.id
}

# SSL Certificate Profile Creation
ssl_certificate {
    name = "{certificateName]"
    key_vault_secret_id = data.azurerm_key_vault_secret.certificate.id
}

[arestarh]

@swes1110 It's indeed working code sample - we are using it for quite some time now.

[francescopersico]

Looks to me like the Azure API for application gateway's doesn't allow you to select a key vault certificate any way other than the secret identifier. Have you tried using a key vault data source like this? (code may not be perfect, haven't tested it)

# Get Key Vault ID
data "azurerm_key_vault" "keyVault" {
  name = "{keyVaultName}"
  resource_group_name = "{keyVaultResourceGroupName}"
}

# Get ID for latest certificate version in KV
data "azurerm_key_vault_secret" "certificate" {
    name = "{keyVaultCertificateName}"
    key_vault_id = data.azurerm_key_vault.keyVault.id
}

# SSL Certificate Profile Creation
ssl_certificate {
    name = "{certificateName]"
    key_vault_secret_id = data.azurerm_key_vault_secret.certificate.id
}

@swes1110

data "azurerm_key_vault_secret" "certificate_secret" {
  name         = var.custom_domains.certificate_name
  key_vault_id = var.custom_domains.keyvault_id
}

  ssl_certificate {
    name                = "sslcertificate"
    key_vault_secret_id = trimsuffix(data.azurerm_key_vault_secret.certificate_secret.id, "${data.azurerm_key_vault_secret.certificate_secret.version}")
  }

Versionless secret_id working with auto certificate refresh

[arestarh]

@francescopersico Just tried specifying key_vault_secret_id using trimsuffix() function and got error that guys mentioned above or in parent issue:
Error: Error parsing Key Vault Child ID: Azure KeyVault Child Id should have 3 segments, got 2: 'secrets/secrets_name'

[francescopersico]

@francescopersico Just tried specifying key_vault_secret_id using trimsuffix() function and got error that guys mentioned above or in parent issue:
Error: Error parsing Key Vault Child ID: Azure KeyVault Child Id should have 3 segments, got 2: 'secrets/secrets_name'

This issue is exactly about that. The terraform module is requiring to specify exactly a version but is not required by Azure.

[rlaveycal]

This is related to #4408 that was just fixed. It just needs the validator changed here https://github.com/terraform-providers/terraform-provider-azurerm/blob/f3429d9df1c54c8ed966be48ae0e9a45fd893cbb/azurerm/internal/services/network/application_gateway_resource.go#L1016

to be ValidateKeyVaultChildIdVersionOptional

[mal]

I've not seen it mentioned yet, but the current enforcement completely breaks automatic certificate renewal. This is because the gateways end up tied to specific cert ID/versions, so when a renewal or import occurs the app gateway is not able to automatically pull the new cert as the ID/version has changed, and continues to use the old cert until TF is re-run and updates the ID.

If at all possible please could this issue be prioritised due to the scale of potential catastrophes that can be caused by expired certs not being replaced when the keyvault is holding the correctly updated one? It's very easy to miss the significance of the ID being enforced when writing the TF configuration and then to end up wondering why certs that should have updated within 24 hours (as per Azure integration docs), have not.

The instances also poll Key Vault at 24-hour intervals to retrieve a renewed version of the certificate, if it exists. If an updated certificate is found, the TLS/SSL certificate currently associated with the HTTPS listener is automatically rotated.
~ https://docs.microsoft.com/en-us/azure/application-gateway/key-vault-certs

[ghost]

This has been released in version 2.14.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.14.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!