az keyvault create not idempotent with access policies

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Describe the bug

The “az keyvault create” command is not idempotent with Access Policies. On re-running the command the Access Policies are deleted/removed.

To Reproduce

Create a KeyVault with az keyvault create e.g. “az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup”

Assign an access policy to the KeyVault, either manually in the portal, or via another Azure CLI or PowershellAz command.

Run the “az keyvault create --location westus2 --name MyKeyVault --resource-group MyResourceGroup” command again

The access policy has been removed/deleted

Expected behavior Leave the Access Policy alone

Environment summary

All environments

Additional context

[pascalnaber]

@yungezz Maybe I don’t understand what you mean with client side idempotency. Because I would not know why somebody needs that. Idempotency is about server side behavior if you ask me.

If I read about the az cli Standard Command Types, The CREATE command MUST be idempotent according to the documentation.

https://github.com/Azure/azure-cli/blob/dev/doc/command_guidelines.md#standard-command-types

Hopefully, the behavior of the Keyvault can be changed soon according to the cli guidelines.

[puagarwa]

@bim-msft Is there any ETA for this fix ? I am also facing this issue in my CMK code where i create key vault and then add ACL for CMK to work but once we deploy template again, things break because it altogether remove access policy. I have to everything via ARM here.