I got a VM defined in terraform like this:

resource "azurerm_linux_virtual_machine" "vm" {
  name                            = var.vm-name
  resource_group_name             = var.RG
  location                        = var.location
  size                            = var.vm-size
  admin_username                  = data.azurerm_key_vault_secret.username.value
  disable_password_authentication = true
  proximity_placement_group_id    = data.azurerm_proximity_placement_group.proximity-group.id

  tags = var.tags
  network_interface_ids = [

  admin_ssh_key {
    username   = data.azurerm_key_vault_secret.username.value
    public_key = data.azurerm_key_vault_secret.pub.value

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_ZRS"

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-focal"
    sku       = "20_04-lts-gen2"
    version   = "latest"

Every time I run tf apply it thinks that the admin_username has been changed and wants to redeploy the machine. This is happening to several environments I'm working with so logically I'm doing something wrong but I can't figure out what..

  • It would be helpful to see the data block where you are referencing key vault. Particularly if you are referencing key_vault_id = data.azurerm_key_vault.existing.id Mar 2, 2022 at 13:00
  • Hi, datablock looks like this: data "azurerm_key_vault" "kv" { resource_group_name = var.RG-Keyvault name = var.keyvaultname }
    – dahol
    Mar 3, 2022 at 15:00

1 Answer 1


So, in short, there is a bug/feature in terraform, and the posted solution was to output the keyvault_id from the keyvault module, then declaring the output value as a variable to pass into other modules. So when getting the secrets now, I use the output value as key_vault_id in the data-block for the secrets like this:

data "azurerm_key_vault_secret" "username" {
  name         = var.username
  key_vault_id = var.keyvault_id

instead of this:

data "azurerm_key_vault_secret" "username" {
  name         = var.username
  key_vault_id = data.azurerm_key_vault.kv.id

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.