Resolved

Azure Key Vault rejects IPv6 addresses in network ACL rules

Azure
Key Vault
Terraform
Networking
Security
IPv6
DevOps
Infrastructure

Terraform deployment fails when configuring Key Vault network ACLs with IPv6 addresses | Azure Key Vault only supports IPv4 for IP-based firewall rules, causing validation errors

Issue

The deployment of Azure Key Vault using Terraform failed due to a conflict between IPv6-only environments and Key Vault’s support for IPv4-only firewall rules. Despite the IPv6 addresses being syntactically valid, the deployment error occurred because Key Vault does not accept IPv6 addresses in its ip_rules field for network ACLs.

Culprit

The root cause was an architectural limitation in Azure Key Vault, which only supports IPv4 addresses for IP-based firewall rules, even though the broader Azure platform supports IPv6 in many other services. The deployment environment was IPv6-only, causing Terraform to use IPv6 addresses for administrative access control, which were then rejected by Key Vault’s validation layer.

Solution

The issue was resolved by:

  1. Replacing IPv6 Addresses with IPv4: The IPv6 address assigned to the admin machine was replaced with a valid IPv4 address in the Terraform configuration.

  2. Layered Access Controls: Key Vault was configured with layered access controls, including a public IPv4 address for administrative access and a virtual network subnet for AKS service endpoints.

  3. Alternative Workarounds: Additional options were considered, such as using Azure Cloud Shell (which provides IPv4 egress), configuring an empty IP list for development environments, or routing traffic through a VPN to provide IPv4 connectivity.

These changes allowed Key Vault to be successfully configured with the correct network ACLs, ensuring secure access from the specified IPv4 address and the AKS subnet while maintaining a deny-by-default policy for all other IPs.