I created a resource azurerm_windows_function_app_slot.

data "azurerm_windows_function_app" "reconciliationFunctionApp" {
  name                = "${local.funcprefix}-func"
  resource_group_name = data.azurerm_resource_group.lp.name
}
resource "azurerm_windows_function_app_slot" "reconciliationFuncSlot" {
  name                       = local.slot
  function_app_id      = data.azurerm_windows_function_app.reconciliationFunctionApp.id
  storage_account_name = azurerm_storage_account.lpstorage.name

  site_config {}

  identity {
    type                              = "SystemAssigned"
    identity_ids                      = []
  }
}

It’s working.

Now I need to reference it when creating an azurerm_key_vault_access_policy. Is there a work-around I can use to create this policy?

resource "azurerm_key_vault_access_policy" "reconciliationFunc" {
   key_vault_id = azurerm_key_vault.lp.id
   tenant_id    = data.azurerm_client_config.current.tenant_id
   object_id    = azurerm_windows_function_app_slot.reconciliationFuncSlot.identity[0].principal_id

   secret_permissions = [
     "Get",
     ...

What I have tried so far:
First, as you can see above, I tried directly referencing the slot resource. That did not work and gives an error ‘error: Missing required argument object_id‘

Next I found this work-around https://github.com/hashicorp/terraform-provider-azurerm/issues/19316 and this answer /a/74096990/2256149 which led me to try this:

data "azurerm_windows_function_app" "reconciliationFuncSlot" {
  name = "${data.azurerm_windows_function_app.reconciliationFunctionApp.name}/slots/${azurerm_windows_function_app_slot.reconciliationFuncSlot.name}"
  resource_group_name = data.azurerm_resource_group.lp.name
  depends_on   = [azurerm_windows_function_app_slot.reconciliationFuncSlot]
}

resource "azurerm_key_vault_access_policy" "reconciliationFunc" {
   key_vault_id = azurerm_key_vault.lp.id
   tenant_id    = data.azurerm_client_config.current.tenant_id
   object_id    = data.azurerm_windows_function_app.reconciliationFuncSlot.identity[0].principal_id

   secret_permissions = [
     "Get",
     ...

But that also produces an error. “Error: ‘name’ may only contain alphanumeric characters and dashes and up to 60 characters in length”

Any suggestions about how I can create a key vault access policy for my function app slot? Thanks!