title: terraform on azure - create keyvault with private connection
body: <p>Would like to get some pointers on setting up a key vault with a private connection. Looking at the examples on the TF site and other sites I put this together but it crashes.</p>
  <p>In short, it creates the KV, assigns some policies, and then creates the private link which is in turn associated with the service endpoint. Any help would be greatly appreciated.</p>
  <pre><code>locals {
    prefix = &quot;kv01am&quot;
  }
  data &quot;azurerm_client_config&quot; &quot;current&quot; {}
  
  resource &quot;azurerm_key_vault&quot; &quot;sandbox&quot; {
    name                        = &quot;${local.prefix}-KV&quot;
    location                    = &quot;eastus2&quot;
    resource_group_name         = &quot;rg-hsc-uscodappname01-137941ad&quot;
    enabled_for_disk_encryption = true
    tenant_id                   = data.azurerm_client_config.current.tenant_id
  #  soft_delete_enabled         = true
  #  purge_protection_enabled    = false
  
    sku_name = &quot;standard&quot;
  
    access_policy {
      tenant_id = data.azurerm_client_config.current.tenant_id
      object_id = data.azurerm_client_config.current.object_id
  
      key_permissions = [
        &quot;get&quot;,
      ]
  
      secret_permissions = [
        &quot;get&quot;,
      ]
  
      storage_permissions = [
        &quot;get&quot;,
      ]
    }
  
    network_acls {
      default_action = &quot;Deny&quot;
      bypass         = &quot;AzureServices&quot;
    }
  
  }
  resource &quot;azurerm_private_link_service&quot; &quot;example&quot; {
    name                        = &quot;kv-privatelink&quot;
    location                    = &quot;eastus2&quot;
    resource_group_name         = &quot;rg-hsc-uscodappname01-137941ad&quot;
  
    nat_ip_configuration {
      name      = azurerm_public_ip.example.name
      primary   = true
      subnet_id = &quot;zzzzzzzzzzzzzzzzzzzzzzzz&quot;
    }
  
  }
  resource &quot;azurerm_private_endpoint&quot; &quot;sandbox_kv&quot; {
    name                        = azurerm_key_vault.sandbox.name
    location                    = &quot;eastus2&quot;
    resource_group_name         = &quot;rg-hsc-uscodappname01-137941ad&quot;
    #subnet_id           = azurerm_subnet.sandbox[&quot;PrivateLink&quot;].id
    subnet_id               = &quot;zzzzzzzzzzzzzzzz&quot;
  
    private_service_connection {
      name                           = azurerm_key_vault.sandbox.name
      private_connection_resource_id = azurerm_key_vault.sandbox.id
      is_manual_connection           = false
      subresource_names = [&quot;Vault&quot;]
    }
  }
  </code></pre>