# Azurerm postgresql flexible server customer\_managed\_key rotation

**URL:** <https://discuss.hashicorp.com/t/azurerm-postgresql-flexible-server-customer-managed-key-rotation/67938>\
**Category:** Azure\
**Created:** [June 18, 2024, 7:09pm UTC](https://discuss.hashicorp.com/t/azurerm-postgresql-flexible-server-customer-managed-key-rotation/67938 "2024-06-18T19:09:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![btbaetwork](https://avatars.discourse-cdn.com/v4/letter/b/d78d45/32.png) [@btbaetwork](https://discuss.hashicorp.com/u/btbaetwork)\
**Post date:** [June 18, 2024, 7:09pm UTC](https://discuss.hashicorp.com/t/azurerm-postgresql-flexible-server-customer-managed-key-rotation/67938/1 "2024-06-18T19:09:58Z")

</div>

So, [Terraform Registry](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/postgresql_flexible_server#customer_managed_key) says that updating the cmk-property of the postgres flexible resource will cause a new resource to be created / the server to be replaced. But we have to pass a key\_vault\_key\_id to that (which includes the key’s version) - i wonder how one could ever rotate the CMK in that case?

I assume the process should be as follows:

- Add a new version to the KeyVaultKey that is used as CMK in Postgres
- Update the key\_vault\_key\_id to the new version  
(also using [Create and manage with data encrypted by customer managed keys using the Azure CLI - Azure Database for PostgreSQL - Flexible Server | Microsoft Learn](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-create-server-customer-managed-key-cli#update-customer-managed-key-on-the-cmk-enabled-azure-database-for-postgresql-flexible-server-instance) as a reference

But that cannot be done with TF because the second step makes TF replace the server?

Or am i just missing some obvious “trick” that would make this possible?

Thank you!

---

<div class="post-metadata">

**Author:** ![ExtelligenceIT](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/extelligenceit/32/41411_2.png) [@ExtelligenceIT](https://discuss.hashicorp.com/u/ExtelligenceIT)\
**Post date:** [June 19, 2024, 4:14pm UTC](https://discuss.hashicorp.com/t/azurerm-postgresql-flexible-server-customer-managed-key-rotation/67938/2 "2024-06-19T16:14:49Z")

</div>

Hi @btbaetwork,

I’m not familiar with the `azurerm_postgresql_flexible_server` but as per the MS documentation related to [Key Vault objects, identifiers, and versioning](https://learn.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#objects-identifiers-and-versioning)

> Objects in Key Vault can be retrieved by specifying a version or by omitting version to get latest version of the object.

So both of the following are valid, with the first one returning a specific version, the second always returning the latest version.  
`https://fookeyvault.vault.azure.net/keys/test/13b4b63acdb942cabb8082d23ed1b460`  
`https://fookeyvault.vault.azure.net/keys/test`

I am not sure how this interacts with the CMK element of the `azurerm_postgresql_flexible_server` so you will need to test and validate. But, in other resources that use keyvault objects, such as app services, if a version is not specified in the reference when newer versions become available, such as with a rotation event, the app will automatically update and begin using the latest version within a certain time period.

In such a scenario, no Terraform deployment is required to update or rotate the key on the resource referencing it.

Hope that helps.

Happy Terraforming