# Destroying Azure Key Vault with policies and/or secrets

**URL:** <https://discuss.hashicorp.com/t/destroying-azure-key-vault-with-policies-and-or-secrets/21251>\
**Category:** Azure\
**Created:** [February 22, 2021, 1:02pm UTC](https://discuss.hashicorp.com/t/destroying-azure-key-vault-with-policies-and-or-secrets/21251 "2021-02-22T13:02:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dsfrederic](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dsfrederic/32/17460_2.png) [@dsfrederic](https://discuss.hashicorp.com/u/dsfrederic)\
**Post date:** [February 22, 2021, 1:02pm UTC](https://discuss.hashicorp.com/t/destroying-azure-key-vault-with-policies-and-or-secrets/21251/1 "2021-02-22T13:02:13Z")

</div>

Hello,

for some reason I’m not able to destroy my terraform workspace. I always get an error for that I’m not authorised to delete a secret. BUT in my terraform file I’m declaring this permission.

So what I think is happening is: terraform destroys policies before it destroys the secret. Since the policies are already gone I do not have authorisation to delete secrets.

I’ve tried adding dependencies but without luck…

Is there a way to set the order of creation/deletion? Or is there something else wrong with my tf file?

```auto
  resource "azurerm_key_vault_access_policy" "policy1" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id = data.azurerm_client_config.current.tenant_id
  object_id = data.azurerm_client_config.current.object_id
  key_permissions = ["Get"]
  secret_permissions = ["Delete", "get", "list", "set"]
  lifecycle {
    create_before_destroy = true
  }

}

resource "azurerm_key_vault_access_policy" "pol2" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id = data.azurerm_client_config.current.tenant_id
  object_id = "REDACTED"
  key_permissions = ["Get"]
  secret_permissions = ["Delete", "get", "list", "set"]
  lifecycle {
    create_before_destroy = true
  }

}

resource "azurerm_key_vault_secret" "secret1" {
  depends_on = [azurerm_key_vault_access_policy.policy1, azurerm_key_vault_access_policy.pol2]
  name = "db-connectionstring"
  value = "Server=tcp:${azurerm_sql_server.sqlserver.fully_qualified_domain_name},1433;Initial Catalog=${azurerm_sql_database.database.name};Persist Security Info=False;User ID=${azurerm_sql_server.sqlserver.administrator_login};Password=${azurerm_sql_server.sqlserver.administrator_login_password};MultipleActiveResultSets=False;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
  key_vault_id = azurerm_key_vault.example.id
}

resource "azurerm_key_vault_secret" "secret2" {
  depends_on = [azurerm_key_vault_access_policy.policy1, azurerm_key_vault_access_policy.pol2]
  name = "sql-administrator-login-password"
  value = random_password.password.result
  key_vault_id = azurerm_key_vault.example.id
}

```

---

<div class="post-metadata">

**Author:** ![dsfrederic](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dsfrederic/32/17460_2.png) [@dsfrederic](https://discuss.hashicorp.com/u/dsfrederic)\
**Post date:** [February 22, 2021, 1:38pm UTC](https://discuss.hashicorp.com/t/destroying-azure-key-vault-with-policies-and-or-secrets/21251/2 "2021-02-22T13:38:38Z")

</div>

Apparantly updating a an access policy causes problems as well… When I update my objectID terraform does not succeed in destroying the old policy. Can anybody help?

---

<div class="post-metadata">

**Author:** ![surlypants](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/surlypants/32/17515_2.png) [@surlypants](https://discuss.hashicorp.com/u/surlypants)\
**Post date:** [February 23, 2021, 10:52pm UTC](https://discuss.hashicorp.com/t/destroying-azure-key-vault-with-policies-and-or-secrets/21251/3 "2021-02-23T22:52:05Z")

</div>

are you using azurerm 2.48.0? i encountered similar. upon downgrading back to 2.47.0, the KVAP removal issue is gone. regression in provider?

---

<div class="post-metadata">

**Author:** ![surlypants](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/surlypants/32/17515_2.png) [@surlypants](https://discuss.hashicorp.com/u/surlypants)\
**Post date:** [February 25, 2021, 7:09pm UTC](https://discuss.hashicorp.com/t/destroying-azure-key-vault-with-policies-and-or-secrets/21251/4 "2021-02-25T19:09:43Z")

</div>

i wonder if this is/was the culprit:

> <https://github.com/terraform-providers/terraform-provider-azurerm/pull/10593>