PurgeProtection = false not allowed by Pulumi AzureNative provider but is allowed when manually creating / bicep deployment

[David-Haile]

What happened?

Hi, I am trying to deploy a keyvault with explicit 'PurgeProtection = false' via the dotnet AzureNative provider. Oddly however, pulumi up shows this as creating a resource but ARM returns an error related to 'updating' the keyvault. Of course because pulumi up then fails the resource does not exist.

In the AzureNative keyvault args I see:

        /// <summary>
        /// Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
        /// </summary>
        [Input("enablePurgeProtection")]
        public Input<bool>? EnablePurgeProtection { get; set; }

Specifically this line 'that is, the property does not accept false as its value.' is very odd to me as I am trying to configure it as false on creation while soft-delete is enabled.

My questions:

• Is it impossible to provision a new non-existent KeyVault as EnablePurgeProtection = false?
• Does Pulumi AzureNative provider first create the keyvault in memory and then update it? (So a POST then PUT request)?
  • This would explain the problem to me because my company has a policy that explicitly does not allow 'updating' the PurgeProtection setting.

For context, my pipeline returns the azure company policy as if I am attempting to update a keyvault that is supposed to be created. After failure, the keyvault resource does not exist.

If EnablePurgeProtection = false on creation is impossible due to how the provider requests this to ARM this would be a massive blocker for my team and project. Typically we don't want this setting on false like everyone else but we require a company endpoint whose job it is to create/remove secrets from a dedicated keyVault. So this would not be done on a keyVault meant for storing regular keys.

It seems to me that passing false to this property should be possible and that creation of the object like in manual creation should be an immediate POST, that could possibly be a bug.

Example

1. Define a keyvault in your program.cs or elsewhere
2. Set PurgeProtection = false
3. Attempt to deploy
4. First phase of Pulumi up (preview) shows [create]. Second phase when deploying returns Azure company Policy error in which you cannot modify the resource despite trying to create it with the setting false.

Note: I want to stress that I am attempting to deploy a new uniquely named KeyVault that doesn't already exist with PurgeProtection=false. Doing so results in the policy error, so I can only imagine provisioning resources happens via a POST and then PUT for certain properties. If that is the case, it is no surprise that policies trigger and this may potentially be a bug.

Output of pulumi about

CLI
Version 3.229.0
Go Version go1.26.1
Go Compiler gc

Plugins
KIND NAME VERSION
resource azure-native 3.17.0
language dotnet unknown

Host
OS Microsoft Windows 11 Pro
Version 10.0.26200 Build 26200
Arch x86_64

This project is written in dotnet: executable='C:\Program Files\dotnet\dotnet.exe' version='10.0.201'

Current Stack: organization/something/stack

TYPE URN
pulumi:pulumi:Stack urn:pulumi:stackinfo
...resources
azure-native:keyvault:Vault urn:pulumi:stack::object::azure-native:keyvault:Vault::kv-mykv

Found no pending operations associated with spoke-ap011-rnd

Backend
Name name
URL azblob://storage
User user
Organizations
Token type personal

Dependencies:
NAME VERSION
Azure.Core 1.55.0
IPNetwork2 4.2.0
OpenTelemetry.Api 1.15.3
OpenTelemetry.Exporter.OpenTelemetryProtocol 1.15.3
Pulumi 3.103.1
Pulumi.AzureNative 3.17.0

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[David-Haile]

Update: I provisioned it while omitting EnablePurgeProtection altogether and it provisioned as disabled. That is to say, either provide null as value to this property or don't set it at all. Adding this property to the body of the provider request triggers the Azure policy.

I am still unsure why the following is the case.
EnablePurgeProtection=false triggers:

error: Status=400 Code="BadRequest" Message="The property "enablePurgeProtection" cannot be set to false. Enabling the purge protection for a vault is an irreverisible action"

This happens even when provisioning a brand new key vault.

Since this is an ARM specific issue, I would suggest modifying the description of the property in the Azure Native provider or modifying the type of the property to either disallow false or not be a boolean at all as it is confusing.