Azure/terraform-azurerm-avm-res-keyvault-vault v0.12.0

on GitHub

Upgrade notes

• Provider constraints changed. AzureRM is now >= 4.81, < 5.0 (#383), so a configuration already on AzureRM 5.x no longer satisfies the module; review provider and state compatibility before moving back to 4.x. AzAPI's floor rose from ~> 2.4 to ~> 2.12.
• Key release policies (#385): keys (root keys and the key submodule) accept an optional release_policy for secure key release on EC-HSM or RSA-HSM keys in a Premium vault. Adding, changing, or removing a policy on an existing key replaces the key and its key material, because the provider marks the block ForceNew. Keys without a policy are unchanged. The key submodule adds a release_policy_configured output.
• Vault role assignment descriptions (#380) are now passed through. Assignments that set description get a one-time in-place update.
• Interface updates: lock accepts notes, and private_endpoints accepts subresource_name (defaults to vault) and ip_configurations[*].member_name. Private endpoint subnet and DNS zone IDs are now validated at plan time, so a malformed ID fails earlier instead of at apply. #384 corrects the private endpoint descriptions, including that role_assignments on private endpoints is currently ignored.

Thanks to @rajsshah86 for the role assignment description fix in #378, which #380 carried to main, and to @jchancellor-ms for requesting release policy support in #37.

What's next

The next release is expected to migrate the vault and its interfaces from AzureRM to AzAPI (#381). That will be a breaking change, so expect upgrade steps with it.

What's Changed

Features

• feat: support release policies on Key Vault keys by @andyleejordan in #385

Bug Fixes

• fix: preserve vault role assignment descriptions by @andyleejordan in #380

Other Changes

• feat(metadata): add approved module metadata by @jaredfholgate in #370
• chore(metadata): remove inactive module owners [AVM owner audit] by @jtracey93 in #379
• fix: constrain AzureRM provider to supported 4.x by @jaredfholgate in #383
• docs: correct private endpoint descriptions by @andyleejordan in #384

Full Changelog: v0.11.0...v0.12.0

Drafted by Copilot with Claude Opus 5.5.