title: Terraform - How to get App Service object id for azurerm key vault access policy?
body: <p>Using Terraform, I am trying to add a keyvault access policy to an application (that is also created in Terraform), which requires an <strong>object_it</strong> (which is GUID) of that application. In ARM template it looks like this:</p>
  
  <pre><code> "objectId": "[reference(variables('myAppResourceId'), '2015-08-31-PREVIEW').principalId]"
  </code></pre>
  
  <p>so Terraform needs the <em>principal id</em> there to be assigned to the <em>object_id</em>. If I use the value <strong>"object_id = ${azurerm_app_service.myApp.id}"</strong> like this:</p>
  
  <pre><code>  resource "azurerm_key_vault_access_policy" "pol1" {
    vault_name          = "${azurerm_key_vault.kv1.name}"
    resource_group_name = "${azurerm_key_vault.kv1.resource_group_name}"
  
    tenant_id = "${data.azurerm_subscription.current.subscription_id}"
    object_id = "${azurerm_app_service.myApp.id}"
  
    key_permissions = "${var.app_keys_permissions}"
    secret_permissions = "${var.app_secrets_permissions}"
  } 
  </code></pre>
  
  <p>then when I run apply command, I get the following error:</p>
  
  <pre><code>azurerm_key_vault_access_policy.pol1: "object_id" is an invalid UUUID: encoding/hex: invalid byte: U+002F '/'
  </code></pre>
  
  <p>this is probably the id that looks like an url with a slash,so this does not work, since I need the GUID only.</p>
  
  <hr>
  
  <p>I tried also a suggestion from <a href="https://stackoverflow.com/questions/51642793/terraform-grant-azure-function-app-with-msi-access-to-azure-keyvault">Terraform grant azure function app with msi access to azure keyvault</a>, by using <strong>object_id = "${lookup(azurerm_app_service.app1.identity[0],"principal_id")}"</strong> for an app service instead of the function and I get an error:</p>
  
  <pre><code> azurerm_key_vault_access_policy.appPolicy1: At column 43, line 1: list "azurerm_app_service.app1.identity" does not have any elements so cannot determine type. in:
  
  ${lookup(azurerm_app_service.app1.identity[0],"principal_id")}
  </code></pre>
  
  <hr>
  
  <p>could someone help me with this object_id please?</p>
  
  <p>thanks</p>