How to fix Error: Error creating Key Vault: VaultAlreadyExists in Terraform

TerraformINTERMEDIATEMEDIUMUpdated Dec 31, 2025· 112 views

This error occurs when trying to create an Azure Key Vault with a name that already exists, either as an active vault or in a soft-deleted state. Azure Key Vaults have globally unique names and are subject to soft-delete retention periods.

Quick fix

Fixes Error: Error creating Key Vault: VaultAlreadyExists

az keyvault list-deleted
  1. Check for soft-deleted Key Vaults
  2. Purge the soft-deleted vault
  3. Recover the soft-deleted vault (alternative)
  4. Configure Terraform to recover soft-deleted vaults
terraform — error
az keyvault list-deleted
Error: Error creating Key Vault: VaultAlreadyExists

What this error means

Azure Key Vault names must be globally unique across all Azure subscriptions and regions. When you delete a Key Vault, it enters a "soft-deleted" state for a retention period (default 90 days) before being permanently removed. If you attempt to create a new vault with the same name before the retention period expires, or if a vault with that name still exists in your subscription, you will receive this error. The Key Vault service prevents name reuse to protect against accidental overwrites and maintain security boundaries.

Typical symptoms

  • Terraform apply fails during Key Vault resource creation with "VaultAlreadyExists" error
  • Unable to create a new Key Vault with the chosen name
  • Error occurs even though you deleted the vault previously
  • CI/CD pipelines fail at the Key Vault provisioning stage
  • Portal shows no active vault but API rejects the name

Common causes

  1. A soft-deleted Key Vault with the same name exists in your subscription (within 90-day retention window)
  2. The Key Vault name already exists as an active resource in another resource group or subscription
  3. Another user or team in your organization created a vault with the same name
  4. Purge protection is enabled on a deleted vault, preventing name reuse
  5. Recent deletion without waiting for the soft-delete retention period to complete

How to fix "Error: Error creating Key Vault: VaultAlreadyExists"

1Check for soft-deleted Key Vaults

First, identify if a soft-deleted vault with your desired name exists:

bash
az keyvault list-deleted

This command lists all soft-deleted Key Vaults in your subscription. Look for the vault name you're trying to create.

2Purge the soft-deleted vault

If you find the vault in the soft-deleted state and want to reuse the name, purge it immediately:

bash
az keyvault purge --name <vault-name> --location <location>

After purging, wait 1-2 minutes before attempting to create the new vault, as the name must fully propagate through Azure services.

3Recover the soft-deleted vault (alternative)

If the deleted vault contains data you want to keep, recover it instead of purging:

bash
az keyvault recover --name <vault-name> --location <location>

Then update your Terraform state to import this recovered vault into your configuration.

4Configure Terraform to recover soft-deleted vaults

Add the recovery feature to your Azure provider configuration to automatically recover soft-deleted vaults when creating a new one:

hcl
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {
    key_vault {
      recover_soft_deleted_key_vaults = true
    }
  }
}

This setting allows Terraform to automatically recover soft-deleted Key Vaults instead of failing.

5Import the existing vault into Terraform state

If a Key Vault already exists and you want to manage it with Terraform, import it into your state file:

bash
terraform import azurerm_key_vault.example \
  /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.KeyVault/vaults/<vault-name>

Then generate or write the corresponding Terraform configuration to match the imported resource.

6Use a unique vault name

If the vault name is taken globally and cannot be recovered, select a different, unique name:

hcl
resource "azurerm_key_vault" "example" {
  name                = "my-unique-vault-${data.azurerm_client_config.current.subscription_id}"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
}

Include a unique suffix (timestamp, subscription ID, or random string) to guarantee global uniqueness.

Advanced notes

Soft-delete is enabled by default for all Key Vaults and cannot be disabled; it is a mandatory feature for Azure Key Vault security and compliance. The retention period ranges from 7 to 90 days depending on your configuration. If purge protection is enabled on the deleted vault, you cannot purge it and must wait for the retention period to expire. Key Vault names follow the pattern: must be 3-24 characters, contain only alphanumerics and hyphens, and start with a letter. For highly available setups, consider using Key Vault names that include a region suffix or deployment identifier to simplify multi-region management.

Frequently asked questions

What does "Error: Error creating Key Vault: VaultAlreadyExists" mean?
Azure Key Vault names must be globally unique across all Azure subscriptions and regions. When you delete a Key Vault, it enters a "soft-deleted" state for a retention period (default 90 days) before being permanently removed. If you attempt to create a new vault with the same name before the retention period expires, or if a vault with that name still exists in your subscription, you will receive this error.
How do I fix "Error: Error creating Key Vault: VaultAlreadyExists"?
This error occurs when trying to create an Azure Key Vault with a name that already exists, either as an active vault or in a soft-deleted state. Azure Key Vaults have globally unique names and are subject to soft-delete retention periods.
What causes "Error: Error creating Key Vault: VaultAlreadyExists"?
A soft-deleted Key Vault with the same name exists in your subscription (within 90-day retention window) The Key Vault name already exists as an active resource in another resource group or subscription Another user or team in your organization created a vault with the same name
Is the "Error: Error creating Key Vault: VaultAlreadyExists" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading