Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support for Azure Redis Cache to use AD Authentication #23777

Closed
1 task done
jonathan-fileread opened this issue Nov 3, 2023 · 8 comments · Fixed by #23976
Closed
1 task done

Support for Azure Redis Cache to use AD Authentication #23777

jonathan-fileread opened this issue Nov 3, 2023 · 8 comments · Fixed by #23976
Labels
enhancement sdk/requires-newer-api-version This requires upgrading the version of the API being used service/redis
Milestone

Comments

@jonathan-fileread
Copy link

jonathan-fileread commented Nov 3, 2023

Is there an existing issue for this?

  • I have searched the existing issues

Community Note

  • Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
  • Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
  • If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Azure Redis now allows AD authentication to use identity based authentication (e.g. through defaultazurecredential) to make a connection string to redis.

Currently this exists in bicep, but not in terraform. We'd love to get a boolean toggle to enable this authentication method! See screenshot below. under Redis > Advanced Settings
Screenshot 2023-11-03 at 6 24 46 PM

New or Affected Resource(s)/Data Source(s)

azurerm_redis_cache

Potential Terraform Configuration

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

# NOTE: the Name used for Redis needs to be globally unique
resource "azurerm_redis_cache" "example" {
  name                = "example-cache"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  capacity            = 2
  family              = "C"
  **entra_authentication = true** <-- this one!
  sku_name            = "Standard"
  enable_non_ssl_port = false
  minimum_tls_version = "1.2"

  redis_configuration {
  }
}

References

https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication

@tombuildsstuff
Copy link
Contributor

Support for this is available in hashicorp/go-azure-sdk in API version 2023-08-01 - however it appears this needs to be updated to use the new API Version to enable this, so I'm tagging this as such.

@tombuildsstuff tombuildsstuff added the sdk/requires-newer-api-version This requires upgrading the version of the API being used label Nov 6, 2023
@Waylonwhynot
Copy link

When does the Terraform-provider-azurerm support this feature?

@favoretti
Copy link
Collaborator

@Waylonwhynot in a bit, PR is being tested as we speak.

@dhensby
Copy link
Contributor

dhensby commented Nov 21, 2023

duplicate of #15068?

@favoretti
Copy link
Collaborator

favoretti commented Nov 21, 2023

duplicate of #15068?

Is it? Not sure to be honest. #15066 looks more like accessing underlying storage accounts using an either user-assigned or system-assigned managed identity, where as this is authentication towards redis instance itself?

https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication

@dhensby
Copy link
Contributor

dhensby commented Nov 21, 2023

Ah - ok - I thought they were related, but if they are distinct then that's fair enough

manicminer added a commit that referenced this issue Nov 28, 2023
… argument (#23976)

* `azurerm_redis_cache`: Add `entra_enabled` argument

Fixes #23777

* tflint

* tflint

* Renamed property

* Fix typo in flatten

* redis: test fixes

* redis: more test fix

---------

Co-authored-by: Tom Bamford <tom@bamford.io>
@github-actions github-actions bot added this to the v3.83.0 milestone Nov 28, 2023
@jonathan-fileread
Copy link
Author

jonathan-fileread commented Jan 4, 2024

thanks @favoretti @manicminer for pushing this one out.
While toggle for enabling AAD is now enabled, we're still missing functionality to add a redis_user, or access_policies via terraform. Should I create another ticket for this?

Screenshot 2024-01-04 at 3 02 11 PM

Copy link

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Apr 28, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
enhancement sdk/requires-newer-api-version This requires upgrading the version of the API being used service/redis
Projects
None yet
6 participants