title: Terraform Script Copy Certificate from datasource Key Vault to new Key Vault
body: <p>I am looking to copy a single certificate from Test1-KV to New-KV with teh following code, but I am receiving the following error:</p>
  <p>azurerm_key_vault_certificate.new-cert: Creating...</p>
  <p>Error: keyvault.BaseClient#CreateCertificate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code=&quot;BadParameter&quot; Message=&quot;Property policy has invalid value\r\n&quot;</p>
  <p>on resources.tf line 91, in resource &quot;azurerm_key_vault_certificate&quot; &quot;new-cert&quot;:
  91: resource &quot;azurerm_key_vault_certificate&quot; &quot;new-cert&quot; {</p>
  <p>Code:</p>
  <pre><code>data &quot;azurerm_key_vault&quot; &quot;existing&quot; {
    name                = &quot;Test1-KV&quot;
    resource_group_name = &quot;Test1-RG&quot;
    
  }
  
  data &quot;azurerm_key_vault_certificate&quot; &quot;new-cert&quot; {
    name          = &quot;new-cert&quot;
    key_vault_id  = data.azurerm_key_vault.existing.id
  }
  
  resource &quot;azurerm_key_vault_certificate&quot; &quot;new-cert&quot; {
    name         = &quot;new-cert&quot;
    key_vault_id = azurerm_key_vault.new-kv.id
  
    certificate_policy {
      issuer_parameters {
        name = &quot;My CA&quot;
      }
      key_properties {
        exportable = true
        key_size   = 2048
        key_type   = &quot;RSA&quot;
        reuse_key  = true
      }
      secret_properties {
        content_type = &quot;application/x-pkcs12&quot;
      }
    }
  }
  </code></pre>
  <p>//edit part: here is my full code. to copying secrets and certificate into New-KV from Test1-KV.</p>
  <pre><code>provider &quot;azurerm&quot; {
      version = &quot;~&gt;2.14.0&quot;
      features {}
  }
  
  resource &quot;azurerm_resource_group&quot; &quot;main&quot; {
    name     = &quot;${var.prefix}-RG&quot;
    location = var.location
  }
  
  # --- Get reference to logged on Azure subscription ---
  data &quot;azurerm_client_config&quot; &quot;current&quot; {}
  
  
  resource &quot;azurerm_key_vault&quot; &quot;NewKV&quot; {
    name                        = &quot;New-KV&quot;
    location                    = azurerm_resource_group.main.location
    resource_group_name         = azurerm_resource_group.main.name
    enabled_for_disk_encryption = true
    tenant_id                   = data.azurerm_client_config.current.tenant_id
    soft_delete_enabled         = true
    purge_protection_enabled    = false
  
  
    sku_name = &quot;standard&quot;
    
  
    access_policy {
      tenant_id = data.azurerm_client_config.current.tenant_id
      object_id = data.azurerm_client_config.current.object_id
  
      certificate_permissions = [
        &quot;create&quot;,
        &quot;delete&quot;,
        &quot;deleteissuers&quot;,
        &quot;get&quot;,
        &quot;getissuers&quot;,
        &quot;import&quot;,
        &quot;list&quot;,
        &quot;listissuers&quot;,
        &quot;managecontacts&quot;,
        &quot;manageissuers&quot;,
        &quot;setissuers&quot;,
        &quot;update&quot;,
      ]
  
      key_permissions = [
        &quot;backup&quot;,
        &quot;create&quot;,
        &quot;decrypt&quot;,
        &quot;delete&quot;,
        &quot;encrypt&quot;,
        &quot;get&quot;,
        &quot;import&quot;,
        &quot;list&quot;,
        &quot;purge&quot;,
        &quot;recover&quot;,
        &quot;restore&quot;,
        &quot;sign&quot;,
        &quot;unwrapKey&quot;,
        &quot;update&quot;,
        &quot;verify&quot;,
        &quot;wrapKey&quot;,
      ]
  
      secret_permissions = [
        &quot;backup&quot;,
        &quot;delete&quot;,
        &quot;get&quot;,
        &quot;list&quot;,
        &quot;purge&quot;,
        &quot;recover&quot;,
        &quot;restore&quot;,
        &quot;set&quot;,
      ]
   
  
    }
  }
  # -------------------- Importing Secrets from Central Key Vault to New-KV ---------------------------
  
  # --- Defining where to import secrets ---
  data &quot;azurerm_key_vault&quot; &quot;existing&quot; {
    name                = &quot;Test1-KV&quot;
    resource_group_name = &quot;Test1-RG&quot;
    
  }
  
  # --- telling what to import ---
  data &quot;azurerm_key_vault_secret&quot; &quot;Cred&quot; {
    name         = &quot;Cred&quot;
    key_vault_id = data.azurerm_key_vault.existing.id
  }
  
  # --- defining where to import ---
  resource &quot;azurerm_key_vault_secret&quot; &quot;Cred&quot; {
    name         = &quot;Cred&quot;
    value        = data.azurerm_key_vault_secret.Cred.value
    key_vault_id = azurerm_key_vault.NewKV.id
  }
  
  # ----------------------- Importing Certificate from Central Key Vault Certificates ----------------------------------
  
  // It stores the actual cert as a secret
  data &quot;azurerm_key_vault_secret&quot; &quot;New-Cert&quot; {
    name         = &quot;New-Cert&quot;
    key_vault_id = data.azurerm_key_vault.existing.id
  }
  
  data &quot;azurerm_key_vault_certificate&quot; &quot;New-Cert&quot; {
    name         = &quot;New-Cert&quot;
    key_vault_id = data.azurerm_key_vault.existing.id
  }
  
  resource &quot;azurerm_key_vault_certificate&quot; &quot;New-Cert&quot; {
    name         = &quot;New-Cert&quot;
    key_vault_id = azurerm_key_vault.NewKV.id
  
    certificate {
      contents = data.azurerm_key_vault_secret.New-Cert.value
    }
  
    certificate_policy {
      issuer_parameters {
        name = &quot;My Company CA&quot;
      }
  
      key_properties {
        exportable = true
        key_size   = 2048
        key_type   = &quot;RSA&quot;
        reuse_key  = true
      }
  
      lifetime_action {
        action {
          action_type = &quot;AutoRenew&quot;
        }
  
        trigger {
          days_before_expiry = 30
        }
      }
  
      secret_properties {
        content_type = &quot;application/x-pkcs12&quot;
      }
  
      x509_certificate_properties {
        # Server Authentication = 1.3.6.1.5.5.7.3.1
        # Client Authentication = 1.3.6.1.5.5.7.3.2
        extended_key_usage = [&quot;1.3.6.1.5.5.7.3.1&quot;]
  
        key_usage = [
                 
          &quot;digitalSignature&quot;,
          &quot;keyEncipherment&quot;,
        ]
  
        subject_alternative_names {
          dns_names = [&quot;hello-world.io&quot;, &quot;Hello-World&quot;]
        }
  
        subject            = &quot;CN=New-Cert&quot;
        validity_in_months = 61
      }
    }
  }
  </code></pre>