azurerm_mssql_database - missing support for keys from a Managed HSM Key Vault

[bmistry12]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.2.9

AzureRM Provider Version

3.116.0

Affected Resource(s)/Data Source(s)

azurerm_mssql_database

Terraform Configuration Files

resource "azurerm_user_assigned_identity" "hsm_idn" {
  name                = "hsm-idn"
  resource_group_name = "resource_group_name"
  location            = "location"
}

resource "azurerm_mssql_server" "server" {
  name                          = "testdbserver"
  location                      = local.location
  resource_group_name           = local.test_rg
  version                       = "12.0"
  administrator_login           = "xxxx"
  administrator_login_password  = "xxxx"
  minimum_tls_version           = "1.2"
  public_network_access_enabled = false

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_mssql_database" "db" {
  name           = "testdb"
  server_id      = azurerm_mssql_server.server.id
  license_type   = "LicenseIncluded"
  collation      = "SQL_Latin1_General_CP1_CI_AS"
  max_size_gb    = 1
  read_scale     = false
  zone_redundant = false
  create_mode = "Default"
  sku_name = "Basic"
  transparent_data_encryption_enabled = true
  transparent_data_encryption_key_vault_key_id = "https://<hsm_id>.managedhsm.azure.net/keys/<key_name>/<key_version>"
  identity {
    type = "UserAssigned"
    identity_ids = [
      azurerm_user_assigned_identity.hsm_idn.id
    ]
  }
}

Debug Output/Panic Output

│ Error: parsing "https://<hsm_id>.managedhsm.azure.net/keys/<key_name>/<key_version>"": internal-error: Managed HSM IDs are not supported as Key Vault Nested Items

Expected Behaviour

The parameter key_vault_key_id should accept a value with ".managedhsm.". Alternatively a new field should be added specifically for managed HSM KVs (e.g. managed_hsm_key_vault_key_id).

Actual Behaviour

The error in Debug Output is thrown.

In the azurerm_mssql_database resource, the key vault id is passed to keyvaultParser → the parser explicitly checks for .managedhsm. in the id . If it exists, the error experienced is thrown.

Steps to Reproduce

Run a terraform apply

Important Factoids

No

References

Similar issues have already been raised / completed previously for other resource types.

• disk_encryption_set doesn't support referencing a key in a managed HSM key vault in the key_vault_key_id #21470
• `azurerm_mssql_server_transparent_data_encryption: support for Key Vault Keys from a Managed HSM #22977
• azurerm_netapp_account_encryption: support for Key Vault Keys from a Managed HSM #26392
• azurerm_cosmosdb_account - Support for Key Vault Keys from a Managed HSM #26357
• azurerm_postgresql_flexible_server: support for Key Vault Keys from a Managed HSM #26338