Using Terraform to create Key Vault secret for Virtual Machine password

Question

I am using the Terraform resource random_string to generate a password for the local Administrator account of VMs. For Windows VMs, I am calling the resource from the admin_password property under the os_profile block. I would like to then write the password (in the same deployment) to a Key Vault Secret using the azurerm_key_vault_secret resource with the value property set to ${azurerm_virtual_machine.vm.os_profile.admin_password}. When I do this, it throws the error below:

Resource 'azurerm_virtual_machine.vm' does not have attribute 'os_profile.admin_password' for variable 'azurerm_virtual_machine.vm.os_profile.admin_password

Am I doing something wrong or is this something that is just not supported? I could create the Secrets in a separate deployment before running the VM deployment and then reference the value using a data resource but for deployments that may create multiple VMs (varying quantity) it would be nice to create them using the count.index method.

Answer 1

its not supported, you cannot read the password after creating the vm, you can only change it (not with the create\edit vm rest call). so you need to save it to a temporary variable and save it to KV, or save it to KV and make VM pull that secret from the KV.