Azure Disk Encryption - via Terraform with Key vault - VmExtensionProvisioningError

If you want to configure a key vault for Azure Disk Encryption, please refer to the following steps. For more details, please refer to here

1. Create a service principal and assign

az login
az account set --subscription "SUBSCRIPTION_ID"
az ad sp create-for-rbac --role "Contributor" --scopes "/subscriptions/<subscription_id>"

2. My variable file

variable "resource_group_name" {
  description = "Default resource group name that the network will be created in"
  default     = ""
}

variable "location" {
  description = "The location/region where the core network will be created. The full list of Azure regions can be found at https://azure.microsoft.com/regions"
  default     = "East Asia"
}

variable key_vault_name {
  description = "Name of the keyVault"
  default     = "hurykeyv"
}

variable virtual_machine_id {
    description = "the resource id of the vm"
    default     = ""
}
variable encryption_algorithm {
  description = " Algo for encryption"
  default     = "RSA-OAEP"
}

variable "volume_type" {
  default = "All"
}

variable "encrypt_operation" {
  default = "EnableEncryption"
}

variable "type_handler_version" {
  description = "Type handler version of the VM extension to use. Defaults to 2.2 on Windows and 1.1 on Linux"
  default     = "2.2"
}

My script file

provider "azurerm" {

    version = "~>2.0"
        subscription_id = ""
        client_id = "sp appId"
        client_secret = "sp password"
        tenant_id = "sp tenant"
        features {}

}
resource "random_string" "password" {
  length  = 16
  special = false
}

data "azurerm_resource_group" "test" {
  name = var.resource_group_name
}

resource "azurerm_key_vault" "keyvault" {
  name                = var.key_vault_name
  resource_group_name = var.resource_group_name
   enabled_for_disk_encryption = true
   enabled_for_deployment=true
   enabled_for_template_deployment =true
   location=data.azurerm_resource_group.test.location
   sku_name = "standard"
   tenant_id=data.azurerm_client_config.current.tenant_id
   soft_delete_enabled=true
   soft_delete_retention_days=90
   
}

resource "azurerm_key_vault_access_policy" "myPolicy" {
  key_vault_id = azurerm_key_vault.keyvault.id

  tenant_id = data.azurerm_client_config.current.tenant_id
  object_id = data.azurerm_client_config.current.object_id
  
  key_permissions = [
    "get",
    "create",
    "delete"
  ]
}

resource "azurerm_key_vault_key" "testKEK" {
  name         = "testKEK"
  key_vault_id = azurerm_key_vault.keyvault.id
  key_type     = "RSA"
  key_size     = 2048
   depends_on = [
    azurerm_key_vault_access_policy.myPolicy
  ]
  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
}
 
resource "azurerm_virtual_machine_extension" "vmextension" {
  name                       = random_string.password.result
  virtual_machine_id         = var.virtual_machine_id
  publisher                  = "Microsoft.Azure.Security"
  type                       = "AzureDiskEncryption"
  type_handler_version       = var.type_handler_version
  auto_upgrade_minor_version = true

  settings = <<SETTINGS
    {
        "EncryptionOperation": "${var.encrypt_operation}",
        "KeyVaultURL": "${azurerm_key_vault.keyvault.vault_uri}",
        "KeyVaultResourceId": "${azurerm_key_vault.keyvault.id}",                   
        "KeyEncryptionKeyURL": "${azurerm_key_vault_key.testKEK.id}",
        "KekVaultResourceId": "${azurerm_key_vault.keyvault.id}",                   
        "KeyEncryptionAlgorithm": "${var.encryption_algorithm}",
        "VolumeType": "${var.volume_type}"
    }
SETTINGS

  
}