generated from Azure/terraform-verified-module
-
Notifications
You must be signed in to change notification settings - Fork 22
/
main.shares.tf
65 lines (56 loc) · 2.68 KB
/
main.shares.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
resource "azurerm_storage_share" "this" {
for_each = var.shares
name = each.value.name
quota = each.value.quota
storage_account_name = azurerm_storage_account.this.name
access_tier = each.value.access_tier
enabled_protocol = each.value.enabled_protocol
metadata = each.value.metadata
dynamic "acl" {
for_each = each.value.acl == null ? [] : each.value.acl
content {
id = acl.value.id
dynamic "access_policy" {
for_each = acl.value.access_policy == null ? [] : acl.value.access_policy
content {
permissions = access_policy.value.permissions
expiry = access_policy.value.expiry
start = access_policy.value.start
}
}
}
}
dynamic "timeouts" {
for_each = each.value.timeouts == null ? [] : [each.value.timeouts]
content {
create = timeouts.value.create
delete = timeouts.value.delete
read = timeouts.value.read
update = timeouts.value.update
}
}
depends_on = [azurerm_storage_account.this, time_sleep.wait_for_rbac_before_share_operations]
}
# Enable role assignments for shares
resource "azurerm_role_assignment" "shares" {
for_each = local.shares_role_assignments
principal_id = each.value.role_assignment.principal_id
scope = azurerm_storage_share.this[each.value.share_key].resource_manager_id
condition = each.value.role_assignment.condition
condition_version = each.value.role_assignment.condition_version
delegated_managed_identity_resource_id = each.value.role_assignment.delegated_managed_identity_resource_id
role_definition_id = strcontains(lower(each.value.role_assignment.role_definition_id_or_name), lower(local.role_definition_resource_substring)) ? each.value.role_assignment.role_definition_id_or_name : null
role_definition_name = strcontains(lower(each.value.role_assignment.role_definition_id_or_name), lower(local.role_definition_resource_substring)) ? null : each.value.role_assignment.role_definition_id_or_name
skip_service_principal_aad_check = each.value.role_assignment.skip_service_principal_aad_check
}
resource "time_sleep" "wait_for_rbac_before_share_operations" {
count = length(var.role_assignments) > 0 && length(var.shares) > 0 ? 1 : 0
create_duration = var.wait_for_rbac_before_share_operations.create
destroy_duration = var.wait_for_rbac_before_share_operations.destroy
triggers = {
role_assignments = jsonencode(var.role_assignments)
}
depends_on = [
azurerm_role_assignment.storage_account
]
}