azurerm_disk_encryption_set - unable to rotate azurerm_key_vault_key

[WodansSon]

Notice in the Changes to Outputs that the key_vault_key_url is reflecting that the key has in fact been rotated and is correctly modifying the output (e.g., /3bdd259d0bf14bddafd4631daf4e1527 -> /15851cd417af4e5eab096fa2ee51065d), however due to persisting the versionless key ID in the resource and the state file itself it does not show up as a diff.

Example of Plan output when the Key Vault Key has been Rotated

data.azurerm_client_config.current: Reading...
azurerm_resource_group.repro: Refreshing state... [id=/subscriptions/{subscription}/resourceGroups/repro-disk_encryption_set]
data.azurerm_client_config.current: Read complete after 0s [id={client_config}]
azurerm_key_vault.repro: Refreshing state... [id=/subscriptions/{subscription}/resourceGroups/repro-disk_encryption_set/providers/Microsoft.KeyVault/vaults/reproKeyVault1DES]
azurerm_key_vault_access_policy.service-principal: Refreshing state... [id=/subscriptions/{subscription}/resourceGroups/repro-disk_encryption_set/providers/Microsoft.KeyVault/vaults/reproKeyVault1DES/objectId/{objectId}]
azurerm_key_vault_key.repro: Refreshing state... [id=https://reprokeyvault1des.vault.azure.net/keys/examplekey/1c716d0b46e84ea19a4ddf3e21f72907]
azurerm_disk_encryption_set.repro: Refreshing state... [id=/subscriptions/{subscription}/resourceGroups/repro-disk_encryption_set/providers/Microsoft.Compute/diskEncryptionSets/reproDES]
data.azurerm_disk_encryption_set.existing: Reading...
azurerm_key_vault_access_policy.disk-encryption: Refreshing state... [id=/subscriptions/{subscription}/resourceGroups/repro-disk_encryption_set/providers/Microsoft.KeyVault/vaults/reproKeyVault1DES/objectId/{objectId}]
data.azurerm_disk_encryption_set.existing: Read complete after 0s [id=/subscriptions/{subscription}/resourceGroups/repro-disk_encryption_set/providers/Microsoft.Compute/diskEncryptionSets/reproDES]

Changes to Outputs:
  ~ key_vault_key_url = "https://reprokeyvault1des.vault.azure.net/keys/examplekey/3bdd259d0bf14bddafd4631daf4e1527" -> "https://reprokeyvault1des.vault.azure.net/keys/examplekey/15851cd417af4e5eab096fa2ee51065d"

You can apply this plan to save these new output values to the Terraform state, without changing any real infrastructure.

(Fixes: #22864)

[WodansSon]

[jackofallops]

Thanks @WodansSon

I think we need a slightly different approach here, and need to maintain the Required property on the key_vault_key_id - I've left some comments below if you can take a look over?

Thanks!

[WodansSon]

[jackofallops]

Thanks for the updates @WodansSon - One comment below to address, which I'll push a change for momentarily given the discussed urgency of this one. But otherwise LGTM 👍

[jackofallops]

Tests look good:

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.