PostgreSQL Flexible Server - CMKNotSupportedForGeoRedundantBackupEnabledServer

[XristophD]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.7.3

AzureRM Provider Version

3.94.0

Affected Resource(s)/Data Source(s)

azurerm_postgresql_flexible_server

Terraform Configuration Files

resource "azurerm_postgresql_flexible_server" "postgres_server" {

...

customer_managed_key {

    // primary
    primary_key_vault_key_id          = azurerm_key_vault_key.primary.id
    primary_user_assigned_identity_id = azurerm_user_assigned_identity.primary.id

    // secondary (this or some version of this needs to be added)
    secondary_key_vault_key_id          = azurerm_key_vault_key.secondary.id
    secondary_user_assigned_identity_id = azurerm_user_assigned_identity.secondary.id
 }

 geo_redundant_backup_enabled = true

...

}

Debug Output/Panic Output

Error on apply: 

│ Error: creating Flexible Server (Subscription: "<SubscriptionID>"
│ Resource Group Name: "rg-infr-dev-weu"
│ Flexible Server Name: "psqlflex-infr-dev-weu-1"): polling after Create: polling failed: the Azure API returned the following error:
│ 
│ Status: "CMKNotSupportedForGeoRedundantBackupEnabledServer"
│ Code: ""
│ Message: "Customer Managed Key encryption is not supported for Geo redundant backup enabled server."

Expected Behaviour

PostgreSQL Server is created with CMK configured and geo-redundant backup.

Actual Behaviour

Error on apply:

│ Error: creating Flexible Server (Subscription: ""
│ Resource Group Name: "rg-infr-dev-weu"
│ Flexible Server Name: "psqlflex-infr-dev-weu-1"): polling after Create: polling failed: the Azure API returned the following error:
│
│ Status: "CMKNotSupportedForGeoRedundantBackupEnabledServer"
│ Code: ""
│ Message: "Customer Managed Key encryption is not supported for Geo redundant backup enabled server."

Similar issue existed #20750 , was fixed by updating API version to 2023-03-01-preview, now the API version is 2023-06-01-preview. Seems there is an issue with the current API versionl.

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[neil-yechenwei]

Thanks for raising this issue. Seems I can't reproduce this issue on my local with below tf config. Could you try below tf config to see if the issue still exists? Thanks.

tf config:

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy       = false
      purge_soft_deleted_keys_on_destroy = false
    }
  }
}

data "azurerm_client_config" "current" {}

resource "azurerm_resource_group" "test" {
  name     = "acctestRG-postgresql-test012ssddf3"
  location = "eastus"
}

resource "azurerm_user_assigned_identity" "test" {
  name                = "acctestmitest01123sdsdf12"
  location            = azurerm_resource_group.test.location
  resource_group_name = azurerm_resource_group.test.name
}

resource "azurerm_key_vault" "test" {
  name                     = "acctestkvtest0232sdf2"
  location                 = azurerm_resource_group.test.location
  resource_group_name      = azurerm_resource_group.test.name
  tenant_id                = data.azurerm_client_config.current.tenant_id
  sku_name                 = "standard"
  purge_protection_enabled = true
}

resource "azurerm_key_vault_access_policy" "server" {
  key_vault_id = azurerm_key_vault.test.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_user_assigned_identity.test.principal_id

  key_permissions = ["Get", "List", "WrapKey", "UnwrapKey", "GetRotationPolicy", "SetRotationPolicy"]
}

resource "azurerm_key_vault_access_policy" "client" {
  key_vault_id = azurerm_key_vault.test.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  key_permissions = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify", "GetRotationPolicy", "SetRotationPolicy"]
}

resource "azurerm_key_vault_key" "test" {
  name         = "test"
  key_vault_id = azurerm_key_vault.test.id
  key_type     = "RSA"
  key_size     = 2048
  key_opts     = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"]

  depends_on = [
    azurerm_key_vault_access_policy.client,
    azurerm_key_vault_access_policy.server,
  ]
}

resource "azurerm_resource_group" "test2" {
  name     = "acctestRG-postgresql2-test011s2sdf3"
  location = "westus"
}

resource "azurerm_user_assigned_identity" "test2" {
  name                = "acctestmi2test011sdfs23"
  location            = azurerm_resource_group.test2.location
  resource_group_name = azurerm_resource_group.test2.name
}

resource "azurerm_key_vault" "test2" {
  name                     = "acctestkv2test2ssdf21"
  location                 = azurerm_resource_group.test2.location
  resource_group_name      = azurerm_resource_group.test2.name
  tenant_id                = data.azurerm_client_config.current.tenant_id
  sku_name                 = "standard"
  purge_protection_enabled = true
}

resource "azurerm_key_vault_access_policy" "server2" {
  key_vault_id = azurerm_key_vault.test2.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_user_assigned_identity.test2.principal_id

  key_permissions = ["Get", "List", "WrapKey", "UnwrapKey", "GetRotationPolicy", "SetRotationPolicy"]
}

resource "azurerm_key_vault_access_policy" "client2" {
  key_vault_id = azurerm_key_vault.test2.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = data.azurerm_client_config.current.object_id

  key_permissions = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify", "GetRotationPolicy", "SetRotationPolicy"]
}

resource "azurerm_key_vault_key" "test2" {
  name         = "test2"
  key_vault_id = azurerm_key_vault.test2.id
  key_type     = "RSA"
  key_size     = 2048
  key_opts     = ["decrypt", "encrypt", "sign", "unwrapKey", "verify", "wrapKey"]

  depends_on = [
    azurerm_key_vault_access_policy.client2,
    azurerm_key_vault_access_policy.server2,
  ]
}

resource "azurerm_postgresql_flexible_server" "test" {
  name                   = "acctest-fs-test03312sdfs323"
  resource_group_name    = azurerm_resource_group.test.name
  location               = azurerm_resource_group.test.location
  administrator_login    = "adminTerraform"
  administrator_password = "QDZwsb123"
  storage_mb             = 32768
  version                = "12"
  sku_name               = "B_Standard_B1ms"
  zone                   = "2"

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.test.id, azurerm_user_assigned_identity.test2.id]
  }

  customer_managed_key {
    key_vault_key_id                     = azurerm_key_vault_key.test.id
    primary_user_assigned_identity_id    = azurerm_user_assigned_identity.test.id
    geo_backup_key_vault_key_id          = azurerm_key_vault_key.test2.id
    geo_backup_user_assigned_identity_id = azurerm_user_assigned_identity.test2.id
  }

  geo_redundant_backup_enabled = true
}

[XristophD]

@neil-yechenwei , sorry for the noise, following your example I was able to figure out the issue in our code base. thank you for the time and the exhaustive example.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.