Hello guys.
I am facing this issue with terraform automation.
I have a for_each to loop through a map and generate access policies for a azure key vaul as follow:
resource "azurerm_key_vault_access_policy" "storage" {
for_each = var.storage-foreach
key_vault_id = azurerm_key_vault.tenantsnbshared.id
tenant_id = "<tenant-id"
object_id = azurerm_storage_account.storage-foreach[each.key].identity.0.principal_id
key_permissions = ["get", "Create", "List", "Restore", "Recover", "Unwrapkey", "Wrapkey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify"]
secret_permissions = ["get", "set", "list", "delete", "recover"]
}
my var.storage-foreach is:
variable "storage-foreach" {
type = map(string)
default = { "storage1" = "storage1", "storage2" = "storage2", "storage3" = "storage3", "storage4" = "storage4"}
}
so far everything works just fine while creating the resource, I have all the access policies in place. But, If I try to remove, for example the storage1
from my variable, the storage account get deleted and the access policies related to that specific storage, which is good. And here the main issue I am facing. If I try to add again the same storage in the variable and run a terraform apply , what happen is that the 3 policies still existing they get removed and the access policy for the storage account get created. If I do one more time terraform apply
the logic get inverted, it will delete the first storage account access policy and add the other 3.
So far my understanding is for each terraform apply, it matches the current state with the previous one, and applies the changes it find.
Is there any way that I can use this code to simple update the access policies without deleting any of them?