Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Resource azurerm_federated_identity_credential - Add locks to Create and Delete Function #20003

Merged
merged 2 commits into from
Jan 20, 2023
Merged

Resource azurerm_federated_identity_credential - Add locks to Create and Delete Function #20003

merged 2 commits into from
Jan 20, 2023

Conversation

liuwuliuyun
Copy link
Contributor

Resource azurerm_federated_identity_credential - Add locks to Create and Delete Function

Fixes #19968

@liuwuliuyun
Copy link
Contributor Author

Test with following config

provider "azurerm" {
  features {}
}

locals {
  tf_envs = ["dev", "test", "production", "a", "b", "c"]
  repository_name  = "dummyrepo1"
  random_integer   = 112345
  primary_location = "west europe"
}

resource "azurerm_resource_group" "test" {
  name     = "acctestrg-${local.random_integer}"
  location = local.primary_location
}

resource "azurerm_user_assigned_identity" "test" {
  location            = azurerm_resource_group.test.location
  name                = "acctestuai-${local.random_integer}"
  resource_group_name = azurerm_resource_group.test.name
}

resource "azurerm_federated_identity_credential" "environment" {
  for_each            = toset(local.tf_envs)
  name                = "acctest-${each.key}-federated-credential"
  resource_group_name = azurerm_resource_group.test.name
  audience            = ["api://AzureADTokenExchange"]
  issuer              = "https://token.actions.githubusercontent.com"
  parent_id           = azurerm_user_assigned_identity.test.id
  subject             = "repo:yourgithubaccount/${local.repository_name}:environment:${each.key}"
}

@liuwuliuyun
Copy link
Contributor Author

Test results:

PS C:\Users\yunliu1\Documents\TerraformTest\federated_identity_credential> terraform apply --auto-approve     
╷
│ Warning: Provider development overrides are in effect
│
│ The following provider development overrides are set in the CLI configuration:
│  - hashicorp/azurerm in C:\Users\yunliu1\go\bin
│
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with published releases.
╵

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_federated_identity_credential.environment["a"] will be created
  + resource "azurerm_federated_identity_credential" "environment" {
      + audience            = [
          + "api://AzureADTokenExchange",
        ]
      + id                  = (known after apply)
      + issuer              = "https://token.actions.githubusercontent.com"
      + name                = "acctest-a-federated-credential"
      + parent_id           = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + subject             = "repo:yourgithubaccount/dummyrepo1:environment:a"
    }

  # azurerm_federated_identity_credential.environment["b"] will be created
  + resource "azurerm_federated_identity_credential" "environment" {
      + audience            = [
          + "api://AzureADTokenExchange",
        ]
      + id                  = (known after apply)
      + issuer              = "https://token.actions.githubusercontent.com"
      + name                = "acctest-b-federated-credential"
      + parent_id           = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + subject             = "repo:yourgithubaccount/dummyrepo1:environment:b"
    }

  # azurerm_federated_identity_credential.environment["c"] will be created
  + resource "azurerm_federated_identity_credential" "environment" {
      + audience            = [
          + "api://AzureADTokenExchange",
        ]
      + id                  = (known after apply)
      + issuer              = "https://token.actions.githubusercontent.com"
      + name                = "acctest-c-federated-credential"
      + parent_id           = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + subject             = "repo:yourgithubaccount/dummyrepo1:environment:c"
    }

  # azurerm_federated_identity_credential.environment["dev"] will be created
  + resource "azurerm_federated_identity_credential" "environment" {
      + audience            = [
          + "api://AzureADTokenExchange",
        ]
      + id                  = (known after apply)
      + issuer              = "https://token.actions.githubusercontent.com"
      + name                = "acctest-dev-federated-credential"
      + parent_id           = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + subject             = "repo:yourgithubaccount/dummyrepo1:environment:dev"
    }

  # azurerm_federated_identity_credential.environment["production"] will be created
  + resource "azurerm_federated_identity_credential" "environment" {
      + audience            = [
          + "api://AzureADTokenExchange",
        ]
      + id                  = (known after apply)
      + issuer              = "https://token.actions.githubusercontent.com"
      + name                = "acctest-production-federated-credential"
      + parent_id           = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + subject             = "repo:yourgithubaccount/dummyrepo1:environment:production"
    }

  # azurerm_federated_identity_credential.environment["test"] will be created
  + resource "azurerm_federated_identity_credential" "environment" {
      + audience            = [
          + "api://AzureADTokenExchange",
        ]
      + id                  = (known after apply)
      + issuer              = "https://token.actions.githubusercontent.com"
      + name                = "acctest-test-federated-credential"
      + parent_id           = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + subject             = "repo:yourgithubaccount/dummyrepo1:environment:test"
    }

  # azurerm_resource_group.test will be created
  + resource "azurerm_resource_group" "test" {
      + id       = (known after apply)
      + location = "westeurope"
      + name     = "acctestrg-112345"
    }

  # azurerm_user_assigned_identity.test will be created
  + resource "azurerm_user_assigned_identity" "test" {
      + client_id           = (known after apply)
      + id                  = (known after apply)
      + location            = "westeurope"
      + name                = "acctestuai-112345"
      + principal_id        = (known after apply)
      + resource_group_name = "acctestrg-112345"
      + tenant_id           = (known after apply)
    }

Plan: 8 to add, 0 to change, 0 to destroy.
azurerm_resource_group.test: Creating...
azurerm_resource_group.test: Creation complete after 4s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345]
azurerm_user_assigned_identity.test: Creating...
azurerm_user_assigned_identity.test: Creation complete after 9s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345]
azurerm_federated_identity_credential.environment["test"]: Creating...
azurerm_federated_identity_credential.environment["b"]: Creating...
azurerm_federated_identity_credential.environment["a"]: Creating...
azurerm_federated_identity_credential.environment["dev"]: Creating...
azurerm_federated_identity_credential.environment["c"]: Creating...
azurerm_federated_identity_credential.environment["production"]: Creating...
azurerm_federated_identity_credential.environment["test"]: Creation complete after 6s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-test-federated-credential]
azurerm_federated_identity_credential.environment["a"]: Creation complete after 10s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-a-federated-credential]
azurerm_federated_identity_credential.environment["c"]: Still creating... [11s elapsed]
azurerm_federated_identity_credential.environment["production"]: Still creating... [11s elapsed]
azurerm_federated_identity_credential.environment["dev"]: Still creating... [11s elapsed]
azurerm_federated_identity_credential.environment["b"]: Still creating... [11s elapsed]
stuai-112345/federatedIdentityCredentials/acctest-b-federated-credential]
azurerm_federated_identity_credential.environment["dev"]: Creation complete after 18s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-dev-federated-credential]
azurerm_federated_identity_credential.environment["production"]: Still creating... [21s elapsed]
azurerm_federated_identity_credential.environment["c"]: Still creating... [21s elapsed]
azurerm_federated_identity_credential.environment["production"]: Creation complete after 22s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-production-federated-credential]
azurerm_federated_identity_credential.environment["c"]: Creation complete after 26s [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-c-federated-credential]

Apply complete! Resources: 8 added, 0 changed, 0 destroyed.
PS C:\Users\yunliu1\Documents\TerraformTest\federated_identity_credential> terraform destroy --auto-approve
╷
│ Warning: Provider development overrides are in effect
│
│ The following provider development overrides are set in the CLI configuration:
│  - hashicorp/azurerm in C:\Users\yunliu1\go\bin
│
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with published releases.
╵
azurerm_resource_group.test: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345]
azurerm_user_assigned_identity.test: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345]
azurerm_federated_identity_credential.environment["dev"]: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-dev-federated-credential]
azurerm_federated_identity_credential.environment["test"]: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-test-federated-credential]
azurerm_federated_identity_credential.environment["b"]: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-b-federated-credential]
azurerm_federated_identity_credential.environment["c"]: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-c-federated-credential]
azurerm_federated_identity_credential.environment["production"]: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-production-federated-credential]
azurerm_federated_identity_credential.environment["a"]: Refreshing state... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-a-federated-credential]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # azurerm_federated_identity_credential.environment["a"] will be destroyed
  - resource "azurerm_federated_identity_credential" "environment" {
      - audience            = [
          - "api://AzureADTokenExchange",
        ] -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-a-federated-credential" -> null
      - issuer              = "https://token.actions.githubusercontent.com" -> null
      - name                = "acctest-a-federated-credential" -> null
      - parent_id           = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - subject             = "repo:yourgithubaccount/dummyrepo1:environment:a" -> null
    }

  # azurerm_federated_identity_credential.environment["b"] will be destroyed
  - resource "azurerm_federated_identity_credential" "environment" {
      - audience            = [
          - "api://AzureADTokenExchange",
        ] -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-b-federated-credential" -> null
      - issuer              = "https://token.actions.githubusercontent.com" -> null
      - name                = "acctest-b-federated-credential" -> null
      - parent_id           = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - subject             = "repo:yourgithubaccount/dummyrepo1:environment:b" -> null
    }

  # azurerm_federated_identity_credential.environment["c"] will be destroyed
  - resource "azurerm_federated_identity_credential" "environment" {
      - audience            = [
          - "api://AzureADTokenExchange",
        ] -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-c-federated-credential" -> null
      - issuer              = "https://token.actions.githubusercontent.com" -> null
      - name                = "acctest-c-federated-credential" -> null
      - parent_id           = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - subject             = "repo:yourgithubaccount/dummyrepo1:environment:c" -> null
    }

  # azurerm_federated_identity_credential.environment["dev"] will be destroyed
  - resource "azurerm_federated_identity_credential" "environment" {
      - audience            = [
          - "api://AzureADTokenExchange",
        ] -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-dev-federated-credential" -> null
      - issuer              = "https://token.actions.githubusercontent.com" -> null
      - name                = "acctest-dev-federated-credential" -> null
      - parent_id           = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - subject             = "repo:yourgithubaccount/dummyrepo1:environment:dev" -> null
    }

  # azurerm_federated_identity_credential.environment["production"] will be destroyed
  - resource "azurerm_federated_identity_credential" "environment" {
      - audience            = [
          - "api://AzureADTokenExchange",
        ] -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-production-federated-credential" -> null
      - issuer              = "https://token.actions.githubusercontent.com" -> null
      - name                = "acctest-production-federated-credential" -> null
      - parent_id           = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - subject             = "repo:yourgithubaccount/dummyrepo1:environment:production" -> null
    }

  # azurerm_federated_identity_credential.environment["test"] will be destroyed
  - resource "azurerm_federated_identity_credential" "environment" {
      - audience            = [
          - "api://AzureADTokenExchange",
        ] -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-test-federated-credential" -> null
      - issuer              = "https://token.actions.githubusercontent.com" -> null
      - name                = "acctest-test-federated-credential" -> null
      - parent_id           = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - subject             = "repo:yourgithubaccount/dummyrepo1:environment:test" -> null
    }

  # azurerm_resource_group.test will be destroyed
  - resource "azurerm_resource_group" "test" {
      - id       = "/subscriptions/sid-local/resourceGroups/acctestrg-112345" -> null
      - location = "westeurope" -> null
      - name     = "acctestrg-112345" -> null
      - tags     = {} -> null
    }

  # azurerm_user_assigned_identity.test will be destroyed
  - resource "azurerm_user_assigned_identity" "test" {
      - client_id           = "056ac01c-c8fd-4f69-bada-1c6ed1959922" -> null
      - id                  = "/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345" -> null
      - location            = "westeurope" -> null
      - name                = "acctestuai-112345" -> null
      - principal_id        = "337d4acf-8ed0-48ff-9eca-fca3e4e0558b" -> null
      - resource_group_name = "acctestrg-112345" -> null
      - tags                = {} -> null
      - tenant_id           = "72f988bf-86f1-41af-91ab-2d7cd011db47" -> null
    }

Plan: 0 to add, 0 to change, 8 to destroy.
azurerm_federated_identity_credential.environment["a"]: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-a-federated-credential]
azurerm_federated_identity_credential.environment["dev"]: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-dev-federated-credential]
azurerm_federated_identity_credential.environment["test"]: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-test-federated-credential]
azurerm_federated_identity_credential.environment["b"]: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-b-federated-credential]
azurerm_federated_identity_credential.environment["c"]: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-c-federated-credential]
azurerm_federated_identity_credential.environment["production"]: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345/federatedIdentityCredentials/acctest-production-federated-credential]
azurerm_federated_identity_credential.environment["a"]: Destruction complete after 3s
azurerm_federated_identity_credential.environment["dev"]: Destruction complete after 5s
azurerm_federated_identity_credential.environment["test"]: Destruction complete after 7s
azurerm_federated_identity_credential.environment["b"]: Destruction complete after 9s
azurerm_federated_identity_credential.environment["c"]: Still destroying... [id=/subscriptions/85b3dbca-5974-4067-9669-...entials/acctest-c-federated-credential, 10s elapsed]
azurerm_federated_identity_credential.environment["production"]: Still destroying... [id=/subscriptions/85b3dbca-5974-4067-9669-...cctest-production-federated-credential, 10s elapsed]
azurerm_federated_identity_credential.environment["c"]: Destruction complete after 11s
azurerm_federated_identity_credential.environment["production"]: Destruction complete after 14s
azurerm_user_assigned_identity.test: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acctestuai-112345]
azurerm_user_assigned_identity.test: Still destroying... [id=/subscriptions/85b3dbca-5974-4067-9669-...erAssignedIdentities/acctestuai-112345, 10s elapsed]
azurerm_user_assigned_identity.test: Destruction complete after 10s
azurerm_resource_group.test: Destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 10s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 20s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 30s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 40s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 50s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 1m0s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 1m10s elapsed]
azurerm_resource_group.test: Still destroying... [id=/subscriptions/sid-local/resourceGroups/acctestrg-112345, 1m20s elapsed]
azurerm_resource_group.test: Destruction complete after 1m26s

Destroy complete! Resources: 8 destroyed.
PS C:\Users\yunliu1\Documents\TerraformTest\federated_identity_credential>

katbyte
katbyte approved these changes Jan 20, 2023
View reviewed changes
Copy link
Collaborator

@katbyte katbyte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🔌

@katbyte katbyte merged commit 0807848 into hashicorp:main Jan 20, 2023
katbyte added a commit that referenced this pull request Jan 20, 2023
@katbyte
CHANGELOG #20003
a554893
@github-actions github-actions bot added this to the v3.40.0 milestone Jan 20, 2023
@github-actions
Copy link

This functionality has been released in v3.40.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Feb 20, 2023
@liuwuliuyun liuwuliuyun deleted the fix-19968 branch June 2, 2023 01:54
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@katbyte katbyte katbyte approved these changes

Assignees
No one assigned
Labels
service/authorization size/XS
Projects
None yet
Milestone
v3.40.0
Development

Successfully merging this pull request may close these issues.

azurerm_federated_identity_credential fails due to attempting concurrent writes
2 participants
@liuwuliuyun @katbyte