Same object id in SystemAssigned Identity of AppService and its slot

Question

Hi. I have a problem with having both AppService and its slot the same object id of SystemAssigned identity.
I've created these resources with Terraform. I'm using these IDs to assign these identities in KeyVault and this operation fails because you can't have duplicated identities in key vault's access policies. I also can't use "distinct" operation on identity id's because Terraform forbids run-time evaluation of "for_each" arguments which I should use to create n amount of access policies.

This terraform code is used for both app and its slots creation:

  dynamic "identity" {
    for_each = var.identity
    content {
      type = identity.value["type"]
    }
  }

This is keyvault assignment:

locals {
  identities = distinct(concat([azurerm_app_service.app_service.identity[0]], [ for slot in azurerm_app_service_slot.web_app_slot: slot.identity[0]]))
}

resource "azurerm_key_vault_access_policy" "app_kv_access_policies" {
  for_each = { for identity in local.identities: identity.principal_id => identity }
  key_vault_id = var.devops_kv_id

  tenant_id = each.value.tenant_id
  object_id = each.value.principal_id

  secret_permissions = ["get"]
  key_permissions    = []
}

Answer 1

@Alexander Shushanidze , System Assigned identity will be same for the 'production' slot and the root app service (both are eventually the same resource). So if you just cover only the slots excluding the app service itself while assigning identity in keyvault, you should be good and will not encounter this problem.

   locals {  
      identities = [ for slot in azurerm_app_service_slot.web_app_slot: slot.identity[0]]  
    }  

If your slots are all using same identity, then you can just use the identity from app service resource and not any slot.

   locals {  
      identity = azurerm_app_service.app_service.identity[0]  
    }