Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

storage_account: gracefully degrading when there's a Write Lock or the user doesn't have permissions #4248

Merged
merged 1 commit into from
Sep 5, 2019
Merged

storage_account: gracefully degrading when there's a Write Lock or the user doesn't have permissions #4248

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 51 additions & 19 deletions azurerm/data_source_storage_account.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,10 @@ package azurerm

import (
"fmt"
"net/http"
"strings"

azautorest "github.com/Azure/go-autorest/autorest"
"github.com/hashicorp/terraform/helper/schema"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/tags"
Expand Down Expand Up @@ -273,12 +275,32 @@ func dataSourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) e

d.SetId(*resp.ID)

// handle the user not having permissions to list the keys
d.Set("primary_connection_string", "")
d.Set("secondary_connection_string", "")
d.Set("primary_blob_connection_string", "")
d.Set("secondary_blob_connection_string", "")
d.Set("primary_access_key", "")
d.Set("secondary_access_key", "")

keys, err := client.ListKeys(ctx, resourceGroup, name)
if err != nil {
return err
// the API returns a 200 with an inner error of a 409..
var hasWriteLock bool
var doesntHavePermissions bool
if e, ok := err.(azautorest.DetailedError); ok {
if status, ok := e.StatusCode.(int); ok {
hasWriteLock = status == http.StatusConflict
doesntHavePermissions = status == http.StatusUnauthorized
}
}

if !hasWriteLock && !doesntHavePermissions {
return fmt.Errorf("Error listing Keys for Storage Account %q (Resource Group %q): %s", name, resourceGroup, err)
}
}

accessKeys := *keys.Keys
accountKeys := keys.Keys
if location := resp.Location; location != nil {
d.Set("location", azure.NormalizeLocation(*location))
}
Expand Down Expand Up @@ -316,39 +338,49 @@ func dataSourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) e
d.Set("primary_location", props.PrimaryLocation)
d.Set("secondary_location", props.SecondaryLocation)

if len(accessKeys) > 0 {
pcs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *accessKeys[0].Value, endpointSuffix)
d.Set("primary_connection_string", pcs)
}
if accessKeys := accountKeys; accessKeys != nil {
storageAccessKeys := *accessKeys
if len(storageAccessKeys) > 0 {
pcs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *storageAccessKeys[0].Value, endpointSuffix)
d.Set("primary_connection_string", pcs)
}

if len(accessKeys) > 1 {
scs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *accessKeys[1].Value, endpointSuffix)
d.Set("secondary_connection_string", scs)
if len(storageAccessKeys) > 1 {
scs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *storageAccessKeys[1].Value, endpointSuffix)
d.Set("secondary_connection_string", scs)
}
}

if err := flattenAndSetAzureRmStorageAccountPrimaryEndpoints(d, props.PrimaryEndpoints); err != nil {
return fmt.Errorf("error setting primary endpoints and hosts for blob, queue, table and file: %+v", err)
}

var primaryBlobConnectStr string
if v := props.PrimaryEndpoints; v != nil {
primaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, accessKeys[0].Value)
if accessKeys := accountKeys; accessKeys != nil {
var primaryBlobConnectStr string
if v := props.PrimaryEndpoints; v != nil {
primaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, (*accessKeys)[0].Value)
}
d.Set("primary_blob_connection_string", primaryBlobConnectStr)
}
d.Set("primary_blob_connection_string", primaryBlobConnectStr)

if err := flattenAndSetAzureRmStorageAccountSecondaryEndpoints(d, props.SecondaryEndpoints); err != nil {
return fmt.Errorf("error setting secondary endpoints and hosts for blob, queue, table: %+v", err)
}

var secondaryBlobConnectStr string
if v := props.SecondaryEndpoints; v != nil {
secondaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, accessKeys[1].Value)
if accessKeys := accountKeys; accessKeys != nil {
var secondaryBlobConnectStr string
if v := props.SecondaryEndpoints; v != nil {
secondaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, (*accessKeys)[1].Value)
}
d.Set("secondary_blob_connection_string", secondaryBlobConnectStr)
}
d.Set("secondary_blob_connection_string", secondaryBlobConnectStr)
}

d.Set("primary_access_key", accessKeys[0].Value)
d.Set("secondary_access_key", accessKeys[1].Value)
if accessKeys := accountKeys; accessKeys != nil {
storageAccountKeys := *accessKeys
d.Set("primary_access_key", storageAccountKeys[0].Value)
d.Set("secondary_access_key", storageAccountKeys[1].Value)
}

return tags.FlattenAndSet(d, resp.Tags)
}
56 changes: 56 additions & 0 deletions azurerm/data_source_storage_account_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,37 @@ func TestAccDataSourceAzureRMStorageAccount_basic(t *testing.T) {
})
}

func TestAccDataSourceAzureRMStorageAccount_withWriteLock(t *testing.T) {
dataSourceName := "data.azurerm_storage_account.test"
ri := tf.AccRandTimeInt()
rs := acctest.RandString(4)
location := testLocation()

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMStorageAccountDestroy,
Steps: []resource.TestStep{
{
Config: testAccDataSourceAzureRMStorageAccount_basicWriteLock(ri, rs, location),
},
{
Config: testAccDataSourceAzureRMStorageAccount_basicWriteLockWithDataSource(ri, rs, location),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr(dataSourceName, "account_tier", "Standard"),
resource.TestCheckResourceAttr(dataSourceName, "account_replication_type", "LRS"),
resource.TestCheckResourceAttr(dataSourceName, "primary_connection_string", ""),
resource.TestCheckResourceAttr(dataSourceName, "secondary_connection_string", ""),
resource.TestCheckResourceAttr(dataSourceName, "primary_blob_connection_string", ""),
resource.TestCheckResourceAttr(dataSourceName, "secondary_blob_connection_string", ""),
resource.TestCheckResourceAttr(dataSourceName, "primary_access_key", ""),
resource.TestCheckResourceAttr(dataSourceName, "secondary_access_key", ""),
),
},
},
})
}

func testAccDataSourceAzureRMStorageAccount_basic(rInt int, rString string, location string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "test" {
Expand All @@ -60,6 +91,19 @@ resource "azurerm_storage_account" "test" {
`, rInt, location, rString)
}

func testAccDataSourceAzureRMStorageAccount_basicWriteLock(rInt int, rString string, location string) string {
template := testAccDataSourceAzureRMStorageAccount_basic(rInt, rString, location)
return fmt.Sprintf(`
%s

resource "azurerm_management_lock" "test" {
name = "acctestlock-%d"
scope = "${azurerm_storage_account.test.id}"
lock_level = "ReadOnly"
}
`, template, rInt)
}

func testAccDataSourceAzureRMStorageAccount_basicWithDataSource(rInt int, rString string, location string) string {
config := testAccDataSourceAzureRMStorageAccount_basic(rInt, rString, location)
return fmt.Sprintf(`
Expand All @@ -71,3 +115,15 @@ data "azurerm_storage_account" "test" {
}
`, config)
}

func testAccDataSourceAzureRMStorageAccount_basicWriteLockWithDataSource(rInt int, rString string, location string) string {
config := testAccDataSourceAzureRMStorageAccount_basicWriteLock(rInt, rString, location)
return fmt.Sprintf(`
%s

data "azurerm_storage_account" "test" {
name = "${azurerm_storage_account.test.name}"
resource_group_name = "${azurerm_storage_account.test.resource_group_name}"
}
`, config)
}
71 changes: 52 additions & 19 deletions azurerm/resource_arm_storage_account.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,13 @@ package azurerm
import (
"fmt"
"log"
"net/http"
"regexp"
"strings"

"github.com/Azure/azure-sdk-for-go/services/preview/security/mgmt/v1.0/security"
"github.com/Azure/azure-sdk-for-go/services/storage/mgmt/2019-04-01/storage"
azautorest "github.com/Azure/go-autorest/autorest"
"github.com/hashicorp/go-getter/helper/url"
"github.com/hashicorp/terraform/helper/schema"
"github.com/hashicorp/terraform/helper/validation"
Expand Down Expand Up @@ -973,12 +975,31 @@ func resourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) err
return fmt.Errorf("Error reading the state of AzureRM Storage Account %q: %+v", name, err)
}

// handle the user not having permissions to list the keys
d.Set("primary_connection_string", "")
d.Set("secondary_connection_string", "")
d.Set("primary_blob_connection_string", "")
d.Set("secondary_blob_connection_string", "")
d.Set("primary_access_key", "")
d.Set("secondary_access_key", "")

keys, err := client.ListKeys(ctx, resGroup, name)
if err != nil {
return err
// the API returns a 200 with an inner error of a 409..
var hasWriteLock bool
var doesntHavePermissions bool
if e, ok := err.(azautorest.DetailedError); ok {
if status, ok := e.StatusCode.(int); ok {
hasWriteLock = status == http.StatusConflict
doesntHavePermissions = status == http.StatusUnauthorized
}
}

if !hasWriteLock && !doesntHavePermissions {
return fmt.Errorf("Error listing Keys for Storage Account %q (Resource Group %q): %s", name, resGroup, err)
}
}

accessKeys := *keys.Keys
d.Set("name", resp.Name)
d.Set("resource_group_name", resGroup)
if location := resp.Location; location != nil {
Expand Down Expand Up @@ -1019,35 +1040,44 @@ func resourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) err
d.Set("primary_location", props.PrimaryLocation)
d.Set("secondary_location", props.SecondaryLocation)

if len(accessKeys) > 0 {
pcs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *accessKeys[0].Value, endpointSuffix)
d.Set("primary_connection_string", pcs)
}
if accessKeys := keys.Keys; accessKeys != nil {
storageAccountKeys := *accessKeys
if len(storageAccountKeys) > 0 {
pcs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *storageAccountKeys[0].Value, endpointSuffix)
d.Set("primary_connection_string", pcs)
}

if len(accessKeys) > 1 {
scs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *accessKeys[1].Value, endpointSuffix)
d.Set("secondary_connection_string", scs)
if len(storageAccountKeys) > 1 {
scs := fmt.Sprintf("DefaultEndpointsProtocol=https;AccountName=%s;AccountKey=%s;EndpointSuffix=%s", *resp.Name, *storageAccountKeys[1].Value, endpointSuffix)
d.Set("secondary_connection_string", scs)
}
}

if err := flattenAndSetAzureRmStorageAccountPrimaryEndpoints(d, props.PrimaryEndpoints); err != nil {
return fmt.Errorf("error setting primary endpoints and hosts for blob, queue, table and file: %+v", err)
}

var primaryBlobConnectStr string
if v := props.PrimaryEndpoints; v != nil {
primaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, accessKeys[0].Value)
if accessKeys := keys.Keys; accessKeys != nil {
storageAccountKeys := *accessKeys
var primaryBlobConnectStr string
if v := props.PrimaryEndpoints; v != nil {
primaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, storageAccountKeys[0].Value)
}
d.Set("primary_blob_connection_string", primaryBlobConnectStr)
}
d.Set("primary_blob_connection_string", primaryBlobConnectStr)

if err := flattenAndSetAzureRmStorageAccountSecondaryEndpoints(d, props.SecondaryEndpoints); err != nil {
return fmt.Errorf("error setting secondary endpoints and hosts for blob, queue, table: %+v", err)
}

var secondaryBlobConnectStr string
if v := props.SecondaryEndpoints; v != nil {
secondaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, accessKeys[1].Value)
if accessKeys := keys.Keys; accessKeys != nil {
storageAccountKeys := *accessKeys
var secondaryBlobConnectStr string
if v := props.SecondaryEndpoints; v != nil {
secondaryBlobConnectStr = getBlobConnectionString(v.Blob, resp.Name, storageAccountKeys[1].Value)
}
d.Set("secondary_blob_connection_string", secondaryBlobConnectStr)
}
d.Set("secondary_blob_connection_string", secondaryBlobConnectStr)

if networkRules := props.NetworkRuleSet; networkRules != nil {
if err := d.Set("network_rules", flattenStorageAccountNetworkRules(networkRules)); err != nil {
Expand All @@ -1056,8 +1086,11 @@ func resourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) err
}
}

d.Set("primary_access_key", accessKeys[0].Value)
d.Set("secondary_access_key", accessKeys[1].Value)
if accessKeys := keys.Keys; accessKeys != nil {
storageAccountKeys := *accessKeys
d.Set("primary_access_key", storageAccountKeys[0].Value)
d.Set("secondary_access_key", storageAccountKeys[1].Value)
}

identity := flattenAzureRmStorageAccountIdentity(resp.Identity)
if err := d.Set("identity", identity); err != nil {
Expand Down
53 changes: 53 additions & 0 deletions azurerm/resource_arm_storage_account_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,46 @@ func TestAccAzureRMStorageAccount_requiresImport(t *testing.T) {
})
}

func TestAccAzureRMStorageAccount_writeLock(t *testing.T) {
resourceName := "azurerm_storage_account.testsa"
ri := tf.AccRandTimeInt()
rs := acctest.RandString(4)
location := testLocation()

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testCheckAzureRMStorageAccountDestroy,
Steps: []resource.TestStep{
{
Config: testAccAzureRMStorageAccount_writeLock(ri, rs, location),
},
{
// works around a bug in the test suite where the Storage Account won't be re-read after the Lock's provisioned
Config: testAccAzureRMStorageAccount_writeLock(ri, rs, location),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMStorageAccountExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "account_tier", "Standard"),
resource.TestCheckResourceAttr(resourceName, "account_replication_type", "LRS"),
resource.TestCheckResourceAttr(resourceName, "tags.%", "1"),
resource.TestCheckResourceAttr(resourceName, "tags.environment", "production"),
resource.TestCheckResourceAttr(resourceName, "primary_connection_string", ""),
resource.TestCheckResourceAttr(resourceName, "secondary_connection_string", ""),
resource.TestCheckResourceAttr(resourceName, "primary_blob_connection_string", ""),
resource.TestCheckResourceAttr(resourceName, "secondary_blob_connection_string", ""),
resource.TestCheckResourceAttr(resourceName, "primary_access_key", ""),
resource.TestCheckResourceAttr(resourceName, "secondary_access_key", ""),
),
},
{
ResourceName: resourceName,
ImportState: true,
ImportStateVerify: true,
},
},
})
}

func TestAccAzureRMStorageAccount_premium(t *testing.T) {
resourceName := "azurerm_storage_account.testsa"
ri := tf.AccRandTimeInt()
Expand Down Expand Up @@ -860,6 +900,19 @@ resource "azurerm_storage_account" "import" {
`, template)
}

func testAccAzureRMStorageAccount_writeLock(rInt int, rString, location string) string {
template := testAccAzureRMStorageAccount_basic(rInt, rString, location)
return fmt.Sprintf(`
%s

resource "azurerm_management_lock" "test" {
name = "acctestlock-%d"
scope = "${azurerm_storage_account.testsa.id}"
lock_level = "ReadOnly"
}
`, template, rInt)
}

func testAccAzureRMStorageAccount_premium(rInt int, rString string, location string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "testrg" {
Expand Down
1 change: 1 addition & 0 deletions website/docs/d/storage_account.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ output "storage_account_tier" {

* `secondary_blob_connection_string` - The connection string associated with the secondary blob location

~> **NOTE:** If there's a Write Lock on the Storage Account, or the account doesn't have permission then these fields will have an empty value [due to a bug in the Azure API](https://github.com/Azure/azure-rest-api-specs/issues/6363)
---

* `custom_domain` supports the following:
Expand Down
Loading