Use azurerm_key_vault_certificate_contacts instead

[davidkarlsen]

See https://github.com/hashicorp/terraform-provider-azurerm/pull/19743 and https://github.com/hashicorp/terraform-provider-azurerm/issues/10256 - it might be more optimal to use azurerm_key_vault_certificate_contacts to avoid permission problem when initially creating the KV.

[davidkarlsen]

ah, nvm, this is of course on the consuming-side of things.

[matt-FFFFFF]

Thanks for this. We will consider the implementation detail.

We do not support access policies in the module as yet, preferring Azure role assignments.

In your use case, how would the above affect the use of the dedicated contact resource?

[davidkarlsen]

you get a permission denied because the IAM has not been assigned yet - so instead you do this sequence:

1. create KV
2. create IAM
3. create contact resource, depending on 2)

[matt-FFFFFF]

Thanks. Will swap it out and make dependent on the role assignments

[davidkarlsen]

could this be merged and released?

[matt-FFFFFF]

Hi, I've put this in another PR that's challenging at the moment.

I can pull it out.

[davidkarlsen]

@matt-FFFFFF fix in #39