title: Azurerm: KeyVault Nested Item should contain 2 or 3 segments, got 10
body: <p>I get the error message below:</p>
  <pre><code>Error: parsing &quot;/subscriptions/&lt;subscription_id&gt;/resourceGroups/&lt;resource_group_name&gt;/providers/Microsoft.Network/applicationGateways/&lt;app_gateway_name&gt;/sslCertificates/&lt;cert_name&gt;&quot;: KeyVault Nested Item should contain 2 or 3 segments, got 10 from &quot;subscriptions/&lt;subscription_id&gt;/resourceGroups/&lt;resource_group_name&gt;/providers/Microsoft.Network/applicationGateways/&lt;app_gateway_name&gt;/sslCertificates/&lt;cert_name&gt;&quot;
  </code></pre>
  <p>I suppose the key error is &quot;KeyVault Nested Item should contain 2 or 3 segments, got 10&quot; but I have no idea what this means.</p>
  <p>What I'm trying to do:</p>
  <p>Via Terraform (azurerm), create an application gateway resource with a HTTPS(443) listener. I uploaded the certificate to the Azure Key (with Vault access policy) and created a managed identity to access that cert. In the portal, I can setup the listener with HTTPS using the managed identity and cert - no issues. Everything works as expected.</p>
  <p>However, when I try to do the same in Terraform, I'm getting the error above.</p>
  <p>Here's what I have:</p>
  <pre><code>data &quot;azurerm_key_vault&quot; &quot;cert_store&quot; {
    name                = &quot;certstore&quot;
    resource_group_name = local.resource_group.name
  }
  
  data &quot;azurerm_key_vault_certificate&quot; &quot;tls_cert&quot; {
    name         = &quot;tls_cert&quot;
    key_vault_id = data.azurerm_key_vault.cert_store.id
  }
  
  resource &quot;azurerm_application_gateway&quot; &quot;app_gateway&quot; {
    name                = &quot;app_gateway1&quot;
    resource_group_name = local.resource_group.name
    location            = local.resource_group.location
    sku {
      name     = var.gateway_vars.sku.name
      tier     = var.gateway_vars.sku.tier
      capacity = 2
    }
  
    gateway_ip_configuration {
      name      = &quot;${var.gateway_vars.name}-ip-configuration&quot;
      subnet_id = data.azurerm_subnet.gateway_subnet.id
    }
  
    frontend_port {
      name = &quot;port_80&quot;
      port = 80
    }
  
    frontend_port {
      name = &quot;port_443&quot;
      port = 443
    }
  
    identity {
      type = &quot;UserAssigned&quot;
      identity_ids = [
        azurerm_user_assigned_identity.app_gateway_managed_identity.id
      ]
    }
  
    ssl_certificate {
      key_vault_secret_id = data.azurerm_key_vault_certificate.cert_store.id
      name                = &quot;tls_cert&quot;
    }
  
    frontend_ip_configuration {
      name                 = &quot;frontendIp&quot;
      public_ip_address_id = azurerm_public_ip.app_gateway.id
    }
  
    backend_address_pool {
      name  = &quot;frontend-pool&quot;
      fqdns = [&quot;fqdn.com&quot;]
    }
  
    # https settings - used to connect to backend services via https
    backend_http_settings {
      name                                = &quot;https&quot;
      cookie_based_affinity               = &quot;Disabled&quot;
      port                                = 443
      protocol                            = &quot;Https&quot;
      request_timeout                     = 60
      path                                = &quot;/&quot;
      pick_host_name_from_backend_address = true
    }
  
    http_listener {
      name                           = &quot;http80-listener&quot;
      frontend_ip_configuration_name = &quot;frontendIp&quot;
      frontend_port_name             = &quot;port_80&quot;
      protocol                       = &quot;Http&quot;
    }
  
    http_listener {
      name                           = &quot;https443-listener&quot;
      frontend_ip_configuration_name = &quot;frontendIp&quot;
      frontend_port_name             = &quot;port_443&quot;
      protocol                       = &quot;Https&quot;
      ssl_certificate_name           = &quot;tls_cert&quot;
      require_sni                    = false
    }
  
  
    url_path_map {
      name                               = &quot;path-map&quot;
      default_backend_address_pool_name  = &quot;frontend-pool&quot;
      default_backend_http_settings_name = &quot;https&quot;
      path_rule {
        name                       = &quot;xx&quot;
        paths                      = [&quot;/path&quot;]
        backend_address_pool_name  = &quot;frontend-pool&quot;
        backend_http_settings_name = &quot;https&quot;
      }
  
    }
  
    request_routing_rule {
      name               = &quot;tdr-routing-rule-443&quot;
      rule_type          = &quot;PathBasedRouting&quot;
      http_listener_name = &quot;https443-listener&quot;
      url_path_map_name  = &quot;path-map&quot;
    }
  
  }
  </code></pre>