azurerm_key_vault_certificate: Support curve property for EC keys

[simonbrady]

The azurerm_key_vault_certificate resource allows for ECDSA certificates with a key type of EC, but unlike azurerm_key_vault_key it doesn't let the user specify which elliptic curve to use.

The v7.1 Create Certificate API adds a crv attribute to the KeyProperties type, so this PR updates the keyvault service to the v7.1 API and adds curve to the allowed key properties, matching the behaviour of azurerm_key_vault_key wherever possible.

All the keyvault acceptance tests pass (including new coverage for curve), but I'm raising this as a draft PR to get feedback on some implications of the change.

[simonbrady]

Minor merge conflicts with #10873 which updates the keyvault/mgmt API, but I can easily rebase this if that one's merged first.

[simonbrady]

Rebased off master, questions in #10868 still to be resolved.

[manicminer]

Hi @simonbrady, thanks for this PR! Overall this looks good and the tests are passing, but where possible we need to ensure that existing configurations are not broken. I have some suggestions inline.

If you want to compute the key_size property, you should be able to do this if you move the logic in your gist into the expandKeyVaultCertificatePolicy() function - just be sure to prefer the value set in configuration to prevent unwanted diffs. Also add the Computed flag to the key_size property to let Terraform know.

[manicminer]

Can we add the old value as a hardcoded string, and translate it in the expandKeyVaultCertificatePolicy() function so that existing configurations continue to work?

You will probably need to use CustomizeDiff to suppress the new value in the event the old value is used.

We can add a TODO to remove it in v3.0.

Suggested change

	string(keyvault.P521),
	string(keyvault.P521),
	"SECP256K1", // TODO: remove this in v3.0 as it was renamed to keyvault.P256K

[manicminer]

We should be case-insensitive here until v3.0 to avoid breaking existing configs

Suggested change

	}, false),
	}, true), // TODO: make this case-sensitive in v3.0

[manicminer]

@simonbrady I hope you don't mind, I've pushed the changes detailed in my earlier review including making the key_size property optional in azurerm_key_vault_certificate. Let me know if this doesn't capture your original intent, I'm going to open this for further review in the meantime. Thanks!

[katbyte]

LGTM 👍

[manicminer]

Rebased, now re-running tests

[manicminer]

Tests passing (service flapping, passed on second run)

[simonbrady]

Thanks for all the assistance @manicminer - I hadn't had time to get to this, but I'm going to claim that's exactly what I would've done :)

[ghost]

This has been released in version 2.57.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.57.0"
}
# ... other configuration ...

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.