r-sftp-users.tf

# https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support#supported-algorithms
resource "tls_private_key" "sftp_users_keys" {
  for_each = local.sftp_users_with_ssh_key_enabled

  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "azurerm_storage_account_local_user" "sftp_users" {
  for_each = local.sftp_users

  name = each.key

  storage_account_id = module.storage_account.storage_account_id

  ssh_key_enabled      = each.value.ssh_key_enabled
  ssh_password_enabled = each.value.ssh_password_enabled

  # The first container in the `permissions_scopes` list will always be the default home directory
  home_directory = coalesce(each.value.home_directory, each.value.permissions_scopes[0].target_container)

  # https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support#container-permissions
  dynamic "permission_scope" {
    for_each = each.value.permissions_scopes
    content {
      service       = "blob"
      resource_name = permission_scope.value.target_container
      permissions {
        create = contains(permission_scope.value.permissions, "All") || contains(permission_scope.value.permissions, "Create")
        delete = contains(permission_scope.value.permissions, "All") || contains(permission_scope.value.permissions, "Delete")
        list   = contains(permission_scope.value.permissions, "All") || contains(permission_scope.value.permissions, "List")
        read   = contains(permission_scope.value.permissions, "All") || contains(permission_scope.value.permissions, "Read")
        write  = contains(permission_scope.value.permissions, "All") || contains(permission_scope.value.permissions, "Write")
      }
    }
  }

  dynamic "ssh_authorized_key" {
    for_each = each.value.ssh_key_enabled ? ["auto"] : []
    content {
      key         = tls_private_key.sftp_users_keys[each.key].public_key_openssh
      description = "Automatically generated by Terraform"
    }
  }

  dynamic "ssh_authorized_key" {
    for_each = each.value.ssh_key_enabled ? each.value.ssh_authorized_keys : []
    content {
      key         = ssh_authorized_key.value.key
      description = ssh_authorized_key.value.description
    }
  }

  lifecycle {
    precondition {
      condition = alltrue([
        for scope in each.value.permissions_scopes : contains(keys(module.storage_account.storage_blob_containers), scope.target_container)
      ])
      error_message = format("At least one target container does not exist (or is being deleted) for user %s.", each.key)
    }
    precondition {
      condition = alltrue(flatten([
        for scope in each.value.permissions_scopes : [
          for permission in scope.permissions : contains(local.sftp_users_permissions, permission)
        ]
      ]))
      error_message = format("One or more permissions are wrong for user %s. Allowed values in the list are: %s.", each.key, join(", ", [
        for permission in local.sftp_users_permissions : "'${permission}'"
      ]))
    }
    # Required because otherwise Terraform will apply successfully but the SFTP connection will fail when using the default SFTP connection command line
    postcondition {
      condition     = contains(self.permission_scope[*].resource_name, split("/", self.home_directory)[0])
      error_message = format("The home directory of user %s does not refer to any container in its permissions scopes.", self.name)
    }
  }
}

resource "local_sensitive_file" "sftp_users_private_keys" {
  for_each = var.create_sftp_users_keys ? tls_private_key.sftp_users_keys : {}

  content         = each.value.private_key_pem
  filename        = pathexpand(format("%s/%s_%s.pem", var.sftp_users_keys_path, module.storage_account.storage_account_name, each.key))
  file_permission = "0600"
}

resource "local_sensitive_file" "sftp_users_public_keys" {
  for_each = var.create_sftp_users_keys ? tls_private_key.sftp_users_keys : {}

  content         = each.value.public_key_openssh
  filename        = pathexpand(format("%s/%s_%s.pub", var.sftp_users_keys_path, module.storage_account.storage_account_name, each.key))
  file_permission = "0644"
}