Azure key vault creation error: VaultAlreadyExists - I can't find the existing vault

Question

I'm trying to create a key vault in Azure using this CLI command...

az keyvault create --location $location --name $keyVaultName --resource-group $resourceGroupMainName --output none

But this returns the error...

(VaultAlreadyExists) The vault name '[value of $keyVaultName]' is already in use. Vault names are globaly unique so it is possible that the name is already taken. If you are sure that the vault name was not taken then it is possible that a vault with the same name was recently deleted but not purged after being placed in a recoverable state. If the vault is in a recoverable state then the vault will need to be purged before reusing the name. For more information on soft delete and purging a vault follow this link https://go.microsoft.com/fwlink/?linkid=2147740.

So I ran both of these...

az keyvault list
az keyvault list-deleted

And $keyVaultName does not appear in either list. I've asked a colleague to double-check those results but it really doesn't appear. I've also looked in the Manage deleted vaults blade in the portal and that matches the results from the CLI - it's not there.

I also tried to recover the key vault with that name...

(DeletedVaultNotFound) The specified deleted vault '[value of $keyVaultName]' does not exist.

...and to purge a key vault with that name...

No deleted Vault or HSM was found with name [value of $keyVaultName]

So why does Azure think that the name is already in use?

Answer 1

As provided in the comment, Similar to Storage Accounts in Azure, the keyvault is also unique across globally. You can check the similar error code from the docs,

Your attempt to create a new key vault with the specified name has failed since the name is already in use. If you recently deleted a key vault with this name, it may still be in the soft deleted state

Vault names and Managed HSM pool names are selected by the user and are globally unique.

You can verify the existence using Powershell or Rest API

Answer 2

I found an easier way, which is via UI, you can check if the deleted key vault is in the key vaults management page. I am able to select and purge or recover deleted key vault after clicking the 'manage deleted vaults' hyperlink.

Answer 3

When you create an azure keyvault a soft delete feature is by default enabled which helps the customers to recover their keys and secrets which were accidentally deleted within 90days (default) and for that time period you cannot create another keyvault with the same name as that.

Once soft delete is enabled for Azure Key Vault you cannot disable the soft-delete as it's implemented as a one-way operation and cannot be changed back once enabled. However, You can use the PowerShell cmdlet Remove-AzureRmKeyVault command with the option -InRemovedState and by specifying the location of the deleted key vault with the -Location argument to permanently delete or purge the Azure Key Vault. If you want to permanently delete a key or secret you need to use Remove-AzureKeyVaultKey and Remove-AzureKeyVaultSecret with -InRemovedState parameter. Please refer to How to use Key Vault soft-delete with PowerShell for details.

You can also achieve the same using the Azure CLI. Refer to How to use Key Vault soft-delete with CLI for details.