'Public_network_access_enabled' argument is not supported with terraform azurerm version 3.21.0

sachin gupta 376

I wanted to disabled the public network access in azure keyvault, for that I am running terraform script and added the argument public_network_access_enabled argument in main.tf file. Also, I have upgraded the azurerm version = 3.21.0 as per terraform documentation. when I ran the terraform, I am getting below error.

Error - public_network_access_enabled argument is not expected.

Please find below screenshot of the configurations.

Main.tf= main.tf

variable.tf =

version.tf = version file

Please share your suggestion.

Thank you!

Alistair Ross 7,101 Reputation points Microsoft Employee

2023-01-18T08:59:31.31+00:00

Hello @sachin gupta

Can you provide the full details of your Key Vault resource declaration please.

sachin gupta 376

Hi @Alistair Ross Please find the source code. Please let me know what I am missing here?

module "key_vault" {
    source = "git::https//dev.azure.com/*******"
    private_link_id = var.private_link_ind
    name            = "kv-${local.name_prefix}-01"
    resource_group_name   = var.resource_group_name
    object_id_list        = var.object_id_list
    location              = var.location
    tenant_id             = var.tensnt_id
    sku_name              = var.sku_name
    key_permission        = var.key_permission
    secret_permission     = var.secret_permission
    certificate_permission = var.certificate_permission
    subnet_id              = var.private_link_subnet_id
    purge_protection_enabled = var.purge_protection_enabled
    log_analytics_workpace   = var.log_analytics_workspace_id
    secure_resources         = var.secure_resources
    tags                     = local.tags
    public_network_access_enabled = var.public_network_access_enabled
    
}

Bruno Lucas 4,411 Reputation points MVP

2023-01-19T09:46:28.6333333+00:00

My "version" param is under the "azurerm" bracket that is under the "required providers" bracket. not sure if that is what is making the difference but notice the upgrade messages after I run "terraform init upgrade." Do you get that version upgrade message?

but I also tried your approach, and it upgraded just as well:

what do you get under the ".terraform" folder?:
sachin gupta 376 Reputation points

2023-01-20T20:05:21.63+00:00

I dont have access to see the .terraform folder.
Bruno Lucas 4,411 Reputation points MVP

2023-01-20T20:21:08.67+00:00
Hi Sachin

did you add that as a parameter of the resource "azurerm_key_vault" "example" block?

I have set my syntax in a different way from what you posted. that worked for me:

terraform { required_providers { azurerm = { source = "hashicorp/azurerm" version = "=3.21.0" } } }

after that I run "terraform init -upgrade'

with older versions I had the same issue

if 3.21.0 doesn't work, try 3.27.0 as mentioned here: [https://github.com/hashicorp/terraform-provider-azurerm/issues/18456
sachin gupta 376 Reputation points

2023-01-20T20:21:32.88+00:00
Thank @Bruno Lucas

How my version script is different than yours script code. can you please share more details.

Also, I have tried with version azurerem = 3.27.0. PFB, code.

terraform { required_version = ">=0.14" required_providers { azurerm = "=3.27.0" } backend "azurerm" { } } provider "azurerm" { features {} subscription_id = var.subscription_id tenant_id = var.tensnt_id }
sachin gupta 376 Reputation points

2023-01-20T21:26:16.2766667+00:00

let me try that.

Thanks

1 answer

SanthiSwaroopNaikBukke-4908 595

In the code you provided, the public_network_access_enabled variable is set to var.public_network_access_enabled. You can change the value of this variable to false to disable public network access for the Key Vault.

SanthiSwaroopNaikBukke-4908 595

Here's an example of a Terraform code that can be used to disable public network access for an Azure Key Vault:

Copy code
resource "azurerm_key_vault" "example" {
  name                  = "example-keyvault"
  resource_group_name   = "example-rg"
  location              = "eastus"
  tenant_id             = "example-tenant-id"
  sku_name              = "standard"

  public_network_access_enabled = false

  access_policy {
    tenant_id = "example-tenant-id"
    object_id = "example-object-id"
    secret_permissions = [
      "get",
      "list",
    ]
  }
}
In this example, the public_network_access_enabled property is set to false, which will disable public network access for the Key Vault.

It also defines the resource_group_name, location, tenant_id, and sku_name properties to specify the resource group, location, tenant ID and sku name of the Key Vault.

It also specifies an access policy, which is used to grant permissions to the Key Vault. In this example, the access policy grants get and list permissions for secrets to the specified tenant ID and object ID.

After creating this code, you need to run terraform init and terraform apply to apply the changes and create the KeyVault with public network access disabled.

sachin gupta 376 Reputation points

2023-01-20T21:25:28.9366667+00:00

@Santhi Swaroop Naik Bukke .. hello. I have defined the value in variable.tf file. Whether I hardcode the value as "False" in main.tf or retrieve it from variable.tf, it gives the same error.