diff --git a/keyvault.tf b/keyvault.tf
index d0976aa..fb60050 100644
--- a/keyvault.tf
+++ b/keyvault.tf
@@ -69,6 +69,8 @@ resource "azurerm_key_vault_secret" "default_arb_application" {
 }
 
 resource "azurerm_key_vault_secret" "witness_storage_key" {
+  count = lower(var.witness_type) == "cloud" ? 1 : 0
+
   key_vault_id    = local.key_vault.id
   name            = local.keyvault_secret_names["WitnessStorageKey"]
   value           = base64encode(var.create_witness_storage_account ? azurerm_storage_account.witness[0].primary_access_key : data.azurerm_storage_account.witness[0].primary_access_key)