Answers: <p>So, in short, there is a bug/feature in terraform, and the posted solution was to output the keyvault_id from the keyvault module, then declaring the output value as a variable to pass into other modules.
  So when getting the secrets now, I use the output value as key_vault_id in the data-block for the secrets like this:</p>
  <pre><code>data &quot;azurerm_key_vault_secret&quot; &quot;username&quot; {
    name         = var.username
    key_vault_id = var.keyvault_id
  }
  
  </code></pre>
  <p>instead of this:</p>
  <pre><code>data &quot;azurerm_key_vault_secret&quot; &quot;username&quot; {
    name         = var.username
    key_vault_id = data.azurerm_key_vault.kv.id
  }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2022-03-03T15:07:08.470Z
Answers: 2022-03-03T15:07:08.470Z
Answers: dahol
Body: <p>I got a VM defined in terraform like this:</p>
  <pre><code>resource &quot;azurerm_linux_virtual_machine&quot; &quot;vm&quot; {
    name                            = var.vm-name
    resource_group_name             = var.RG
    location                        = var.location
    size                            = var.vm-size
    admin_username                  = data.azurerm_key_vault_secret.username.value
    disable_password_authentication = true
    proximity_placement_group_id    = data.azurerm_proximity_placement_group.proximity-group.id
  
    tags = var.tags
    network_interface_ids = [
      azurerm_network_interface.nic.id,
    ]
  
    admin_ssh_key {
      username   = data.azurerm_key_vault_secret.username.value
      public_key = data.azurerm_key_vault_secret.pub.value
    }
  
    os_disk {
      caching              = &quot;ReadWrite&quot;
      storage_account_type = &quot;Premium_ZRS&quot;
    }
  
    source_image_reference {
      publisher = &quot;Canonical&quot;
      offer     = &quot;0001-com-ubuntu-server-focal&quot;
      sku       = &quot;20_04-lts-gen2&quot;
      version   = &quot;latest&quot;
    }
  }
  </code></pre>
  <p>Every time I run tf apply it thinks that the admin_username has been changed and wants to redeploy the machine. This is happening to several environments I'm working with so logically I'm doing something wrong but I can't figure out what..</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-03-02T13:00:53.760Z
Comments: It would be helpful to see the data block where you are referencing key vault.  Particularly if you are referencing `key_vault_id = data.azurerm_key_vault.existing.id`
Comments: Ken W - Zero Networks
Comments: CC BY-SA 4.0
Comments: 2022-03-03T15:00:54.623Z
Comments: Hi, datablock looks like this: `data "azurerm_key_vault" "kv" {
    resource_group_name = var.RG-Keyvault
    name                = var.keyvaultname
  }`
Comments: dahol
Tags: <terraform><azure><linux><vm>
Title: Terraform wanting to redeploy azure vms for 'no' reason
UserDisplayName: dahol
ThreadText: # Terraform wanting to redeploy azure vms for 'no' reason
  
  (Asked by: username_0 on 2022-03-02)
  
  I got a VM defined in terraform like this:
  
  ```
  resource "azurerm_linux_virtual_machine" "vm" {
    name                            = var.vm-name
    resource_group_name             = var.RG
    location                        = var.location
    size                            = var.vm-size
    admin_username                  = data.azurerm_key_vault_secret.username.value
    disable_password_authentication = true
    proximity_placement_group_id    = data.azurerm_proximity_placement_group.proximity-group.id
  
    tags = var.tags
    network_interface_ids = [
      azurerm_network_interface.nic.id,
    ]
  
    admin_ssh_key {
      username   = data.azurerm_key_vault_secret.username.value
      public_key = data.azurerm_key_vault_secret.pub.value
    }
  
    os_disk {
      caching              = "ReadWrite"
      storage_account_type = "Premium_ZRS"
    }
  
    source_image_reference {
      publisher = "Canonical"
      offer     = "0001-com-ubuntu-server-focal"
      sku       = "20_04-lts-gen2"
      version   = "latest"
    }
  }
  
  ```
  
  Every time I run tf apply it thinks that the admin\_username has been changed and wants to redeploy the machine. This is happening to several environments I'm working with so logically I'm doing something wrong but I can't figure out what..
  
  **Tags:** terraform, azure, linux, vm
  
  > **Comments:**
  > **username_1**: It would be helpful to see the data block where you are referencing key vault.  Particularly if you are referencing `key_vault_id = data.azurerm_key_vault.existing.id`  
  > **username_0**: Hi, datablock looks like this: `data "azurerm_key_vault" "kv" {   resource_group_name = var.RG-Keyvault   name                = var.keyvaultname }`  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2022-03-03. Score: 1
  
  So, in short, there is a bug/feature in terraform, and the posted solution was to output the keyvault\_id from the keyvault module, then declaring the output value as a variable to pass into other modules.
  So when getting the secrets now, I use the output value as key\_vault\_id in the data-block for the secrets like this:
  
  ```
  data "azurerm_key_vault_secret" "username" {
    name         = var.username
    key_vault_id = var.keyvault_id
  }
  
  ```
  
  instead of this:
  
  ```
  data "azurerm_key_vault_secret" "username" {
    name         = var.username
    key_vault_id = data.azurerm_key_vault.kv.id
  }
  
  ```
  
  
  ---
  
  