This message was deleted.

can you elaborate? it should just be as simple as modifying the code?

as in one project has created a shared keyvault, then another project has inserted a secret, now a resource it creates needs to use a keyvault reference, the only way it can is if it has the access policy updated on the shared keyvault

you’ll need to update the original project

so there's no way to do this : https://docs.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest#az-keyvault-set-policy

yes, there is a way, but that’s an imperative operation. pulumi is declarative If you modify the project with the keyvault in, it’ll basically perform the same API call as

az keyvault set policy

Right, but if I continually re-deploy project 2 generating new system assigned ids - then I'll constantly have to update project 1... but that's no good. It sounds like pulumi doesn't expose an API like

AccessPolicy

, where you can supply a key vault name, an object id and some policies, and it will just run the single command...

generating new system assigned ids

Why would updating the policy generate new system assigned ids?

Why would updating the policy generate new system assigned ids?

other projects will create resources that will have their own system identities, these will be created if the resource is every re-created

if you define a keyvault with an access policy

vault = keyvault.KeyVault(
    "vault",
    resource_group_name=resource_group.name,
    sku_name="standard",
    tenant_id=tenant_id,
    access_policies=[keyvault.KeyVaultAccessPolicyArgs(
        tenant_id=tenant_id,
        object_id=current_principal,
        secret_permissions=["delete", "get", "list", "set"]
    )]
)

Then you want to add a new policy:

vault = keyvault.KeyVault(
    "vault",
    resource_group_name=resource_group.name,
    sku_name="standard",
    tenant_id=tenant_id,
    access_policies=[
      keyvault.KeyVaultAccessPolicyArgs(
        tenant_id=tenant_id,
        object_id=current_principal,
        secret_permissions=["delete", "get", "list", "set"]
       ),
       keyvault.KeyVaultAccessPolicyArgs(
        tenant_id=new_tenant_id,
        object_id=new_current_principal,
        secret_permissions=["delete", "get", "list", "set"])
     
    ]
)

It’ll just update the policy.

that's a bit much for updating a single policy...