Resolved

Terraform apply fails with existing Azure Key Vault and invalid diagnostics

Terraform
Azure
Key Vault
Diagnostics
DevOps
Infrastructure
Compliance
rule

Terraform deployment errors when Key Vault already exists and storage account diagnostics use unsupported log categories | Resolved via import and category correction

Resolving Terraform Deployment Errors for Azure Backend Infrastructure

Issue

Terraform deployment failed during the provisioning of Azure backend infrastructure due to two critical errors:

  1. Resource Conflict: A Key Vault resource (tfstate-kv-mcprag) already existed with compliance-enforced settings (e.g., purge protection and retention policies), preventing Terraform from recreating it.
  2. Diagnostic Misconfiguration: Invalid log categories (StorageRead) were specified for storage account diagnostics, which are only valid at the blob service level.

Culprit

Key Vault Conflict

  • The existing Key Vault had audit trails and compliance settings (e.g., purge protection, 90-day retention) that were required for regulatory compliance.
  • Terraform attempted to recreate the resource, which violated compliance policies and was not permitted.

Diagnostic Settings Misconfiguration

  • The diagnostic settings incorrectly included log categories (StorageRead) that are only applicable at the blob service level, not the storage account level.
  • The separation between log categories and metrics categories was not properly implemented, leading to invalid configuration.

Solution

Key Vault Resolution

  • Imported the existing Key Vault into Terraform state to preserve its compliance settings and audit trails.
  • Ensured all existing configurations (e.g., purge protection, retention policies) remained intact, maintaining compliance with regulatory requirements.

Diagnostic Settings Correction

  • Removed invalid log categories (e.g., StorageRead) from the storage account level and retained only valid metrics categories (e.g., Transaction, Capacity).
  • Validated the blob-level diagnostics to ensure they were correctly configured for logging.

Outcome: The deployment completed successfully with all compliance requirements met, and diagnostic settings properly configured for the storage account and blob service levels.