Export Certificates between Azure KeyVault Instances
So, this should be a quick one. I had a problem recently, I was trying to export certificates from my old Azure Keyvault instance to a new one and i didn't want to download them each and import to the new Azure Keyvault instance.
I picked Terraform to do this as that is what i use to setup the infrastructure already. so here I will assume you have some experience with terraform already and jump right into it.
Now you would expect that the terraform data source azurerm_key_vault_certificate
would be the resource to read the certificate data and create a new certificate resource. However, this data source only fetches the certificate public data and you cannot create a certificate resource with this data.
Also, the terraform data source azurerm_key_vault_certificate_data
provides the certificate data in pem format and the private key.
I have had issues with certificates imported in pem format and application_gateway certificates.
Solution
Apparently the certificate data can be accessed from the terraform data source azurerm_key_vault_secret
and that solved my problem. here is the final script i used.
terraform {
required_version = ">= 0.13"
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "=3.17.0"
}
}
}
provider "azurerm" {
features {}
}
locals {
certificates = [
"certificate_name_1",
"certificate_name_2",
"certificate_name_3",
"certificate_name_4",
"certificate_name_5",
"certificate_name_6"
]
}
data "azurerm_key_vault" "old" {
name = "old_keyvault_name"
resource_group_name = "old_keyvault_resource_group"
}
data "azurerm_key_vault" "new" {
name = "new_keyvault_name"
resource_group_name = "new_keyvault_resource_group"
}
data "azurerm_key_vault_secret" "secrets" {
for_each = toset(local.certificates)
name = each.value
key_vault_id = data.azurerm_key_vault.old.id
}
resource "azurerm_key_vault_certificate" "secrets" {
for_each = data.azurerm_key_vault_secret.secrets
name = each.value.name
key_vault_id = data.azurerm_key_vault.new.id
certificate {
contents = each.value.value
}
}