How to fix Error: Error creating Key Vault: VaultAlreadyExists in Terraform

First, identify if a soft-deleted vault with your desired name exists:

az keyvault list-deleted

This command lists all soft-deleted Key Vaults in your subscription. Look for the vault name you're trying to create.

If you find the vault in the soft-deleted state and want to reuse the name, purge it immediately:

az keyvault purge --name <vault-name> --location <location>

After purging, wait 1-2 minutes before attempting to create the new vault, as the name must fully propagate through Azure services.

If the deleted vault contains data you want to keep, recover it instead of purging:

az keyvault recover --name <vault-name> --location <location>

Then update your Terraform state to import this recovered vault into your configuration.

Add the recovery feature to your Azure provider configuration to automatically recover soft-deleted vaults when creating a new one:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {
    key_vault {
      recover_soft_deleted_key_vaults = true
    }
  }
}

This setting allows Terraform to automatically recover soft-deleted Key Vaults instead of failing.

If a Key Vault already exists and you want to manage it with Terraform, import it into your state file:

terraform import azurerm_key_vault.example \
  /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.KeyVault/vaults/<vault-name>

Then generate or write the corresponding Terraform configuration to match the imported resource.

If the vault name is taken globally and cannot be recovered, select a different, unique name:

resource "azurerm_key_vault" "example" {
  name                = "my-unique-vault-${data.azurerm_client_config.current.subscription_id}"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
}

Include a unique suffix (timestamp, subscription ID, or random string) to guarantee global uniqueness.