azurerm_storage_account - filter allow_blob_public_access and min_tls_version from Azure US Government

azurerm/internal/services/storage/client/client.go

@@ -29,7 +29,7 @@ type Client struct {
 	StorageTargetsClient     *storagecache.StorageTargetsClient
 	SubscriptionId           string
 
-	environment   az.Environment
+	Environment   az.Environment
 	storageAdAuth *autorest.Authorizer
 }
 
@@ -62,7 +62,7 @@ func NewClient(options *common.ClientOptions) *Client {
 		CachesClient:             &cachesClient,
 		SubscriptionId:           options.SubscriptionId,
 		StorageTargetsClient:     &storageTargetsClient,
-		environment:              options.Environment,
+		Environment:              options.Environment,
 	}
 
 	if options.StorageUseAzureAD {
@@ -74,7 +74,7 @@ func NewClient(options *common.ClientOptions) *Client {
 
 func (client Client) AccountsDataPlaneClient(ctx context.Context, account accountDetails) (*accounts.Client, error) {
 	if client.storageAdAuth != nil {
-		accountsClient := accounts.NewWithEnvironment(client.environment)
+		accountsClient := accounts.NewWithEnvironment(client.Environment)
 		accountsClient.Client.Authorizer = *client.storageAdAuth
 		return &accountsClient, nil
 	}
@@ -89,14 +89,14 @@ func (client Client) AccountsDataPlaneClient(ctx context.Context, account accoun
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	accountsClient := accounts.NewWithEnvironment(client.environment)
+	accountsClient := accounts.NewWithEnvironment(client.Environment)
 	accountsClient.Client.Authorizer = storageAuth
 	return &accountsClient, nil
 }
 
 func (client Client) BlobsClient(ctx context.Context, account accountDetails) (*blobs.Client, error) {
 	if client.storageAdAuth != nil {
-		blobsClient := blobs.NewWithEnvironment(client.environment)
+		blobsClient := blobs.NewWithEnvironment(client.Environment)
 		blobsClient.Client.Authorizer = *client.storageAdAuth
 		return &blobsClient, nil
 	}
@@ -111,14 +111,14 @@ func (client Client) BlobsClient(ctx context.Context, account accountDetails) (*
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	blobsClient := blobs.NewWithEnvironment(client.environment)
+	blobsClient := blobs.NewWithEnvironment(client.Environment)
 	blobsClient.Client.Authorizer = storageAuth
 	return &blobsClient, nil
 }
 
 func (client Client) ContainersClient(ctx context.Context, account accountDetails) (*containers.Client, error) {
 	if client.storageAdAuth != nil {
-		containersClient := containers.NewWithEnvironment(client.environment)
+		containersClient := containers.NewWithEnvironment(client.Environment)
 		containersClient.Client.Authorizer = *client.storageAdAuth
 		return &containersClient, nil
 	}
@@ -133,7 +133,7 @@ func (client Client) ContainersClient(ctx context.Context, account accountDetail
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	containersClient := containers.NewWithEnvironment(client.environment)
+	containersClient := containers.NewWithEnvironment(client.Environment)
 	containersClient.Client.Authorizer = storageAuth
 	return &containersClient, nil
 }
@@ -151,7 +151,7 @@ func (client Client) FileShareDirectoriesClient(ctx context.Context, account acc
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	directoriesClient := directories.NewWithEnvironment(client.environment)
+	directoriesClient := directories.NewWithEnvironment(client.Environment)
 	directoriesClient.Client.Authorizer = storageAuth
 	return &directoriesClient, nil
 }
@@ -169,14 +169,14 @@ func (client Client) FileSharesClient(ctx context.Context, account accountDetail
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	sharesClient := shares.NewWithEnvironment(client.environment)
+	sharesClient := shares.NewWithEnvironment(client.Environment)
 	sharesClient.Client.Authorizer = storageAuth
 	return &sharesClient, nil
 }
 
 func (client Client) QueuesClient(ctx context.Context, account accountDetails) (*queues.Client, error) {
 	if client.storageAdAuth != nil {
-		queueAuth := queues.NewWithEnvironment(client.environment)
+		queueAuth := queues.NewWithEnvironment(client.Environment)
 		queueAuth.Client.Authorizer = *client.storageAdAuth
 		return &queueAuth, nil
 	}
@@ -191,7 +191,7 @@ func (client Client) QueuesClient(ctx context.Context, account accountDetails) (
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	queuesClient := queues.NewWithEnvironment(client.environment)
+	queuesClient := queues.NewWithEnvironment(client.Environment)
 	queuesClient.Client.Authorizer = storageAuth
 	return &queuesClient, nil
 }
@@ -209,7 +209,7 @@ func (client Client) TableEntityClient(ctx context.Context, account accountDetai
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	entitiesClient := entities.NewWithEnvironment(client.environment)
+	entitiesClient := entities.NewWithEnvironment(client.Environment)
 	entitiesClient.Client.Authorizer = storageAuth
 	return &entitiesClient, nil
 }
@@ -227,7 +227,7 @@ func (client Client) TablesClient(ctx context.Context, account accountDetails) (
 		return nil, fmt.Errorf("Error building Authorizer: %+v", err)
 	}
 
-	tablesClient := tables.NewWithEnvironment(client.environment)
+	tablesClient := tables.NewWithEnvironment(client.Environment)
 	tablesClient.Client.Authorizer = storageAuth
 	return &tablesClient, nil
 }

azurerm/internal/services/storage/resource_arm_storage_account.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/services/storage/mgmt/2019-04-01/storage"
 	azautorest "github.com/Azure/go-autorest/autorest"
+	autorestAzure "github.com/Azure/go-autorest/autorest/azure"
 	"github.com/hashicorp/go-azure-helpers/response"
 	"github.com/hashicorp/go-getter/helper/url"
 	"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
@@ -604,6 +605,7 @@ func validateAzureRMStorageAccountTags(v interface{}, _ string) (warnings []stri
 }
 
 func resourceArmStorageAccountCreate(d *schema.ResourceData, meta interface{}) error {
+	env := meta.(*clients.Client).Storage.Environment
 	client := meta.(*clients.Client).Storage.AccountsClient
 	ctx, cancel := timeouts.ForCreate(meta.(*clients.Client).StopContext, d)
 	defer cancel()
@@ -648,13 +650,23 @@ func resourceArmStorageAccountCreate(d *schema.ResourceData, meta interface{}) e
 		Kind: storage.Kind(accountKind),
 		AccountPropertiesCreateParameters: &storage.AccountPropertiesCreateParameters{
 			EnableHTTPSTrafficOnly: &enableHTTPSTrafficOnly,
-			MinimumTLSVersion:      storage.MinimumTLSVersion(minimumTLSVersion),
 			NetworkRuleSet:         expandStorageAccountNetworkRules(d),
 			IsHnsEnabled:           &isHnsEnabled,
-			AllowBlobPublicAccess:  &allowBlobPublicAccess,
 		},
 	}
 
+	// For US Government Cloud, don't specify "allow_blob_public_access" and "min_tls_version" in request body.
+	// https://github.com/terraform-providers/terraform-provider-azurerm/issues/7812
+	// https://github.com/terraform-providers/terraform-provider-azurerm/issues/8083
+	if env.Name == autorestAzure.USGovernmentCloud.Name {
+		if allowBlobPublicAccess || minimumTLSVersion != string(storage.TLS10) {
+			return fmt.Errorf(`"allow_blob_public_access" and "min_tls_version" are not supported for a Storage Account located in %q`, env.Name)
+		}
+	} else {
+		parameters.AccountPropertiesCreateParameters.AllowBlobPublicAccess = &allowBlobPublicAccess
+		parameters.AccountPropertiesCreateParameters.MinimumTLSVersion = storage.MinimumTLSVersion(minimumTLSVersion)
+	}
+
 	if _, ok := d.GetOk("identity"); ok {
 		storageAccountIdentity := expandAzureRmStorageAccountIdentity(d)
 		parameters.Identity = storageAccountIdentity
@@ -784,6 +796,7 @@ func resourceArmStorageAccountCreate(d *schema.ResourceData, meta interface{}) e
 }
 
 func resourceArmStorageAccountUpdate(d *schema.ResourceData, meta interface{}) error {
+	env := meta.(*clients.Client).Storage.Environment
 	client := meta.(*clients.Client).Storage.AccountsClient
 	ctx, cancel := timeouts.ForUpdate(meta.(*clients.Client).StopContext, d)
 	defer cancel()
@@ -888,28 +901,44 @@ func resourceArmStorageAccountUpdate(d *schema.ResourceData, meta interface{}) e
 	if d.HasChange("min_tls_version") {
 		minimumTLSVersion := d.Get("min_tls_version").(string)
 
-		opts := storage.AccountUpdateParameters{
-			AccountPropertiesUpdateParameters: &storage.AccountPropertiesUpdateParameters{
-				MinimumTLSVersion: storage.MinimumTLSVersion(minimumTLSVersion),
-			},
-		}
+		// For US Government Cloud, don't specify "min_tls_version" in request body.
+		// https://github.com/terraform-providers/terraform-provider-azurerm/issues/8083
+		if env.Name == autorestAzure.USGovernmentCloud.Name {
+			if minimumTLSVersion != string(storage.TLS10) {
+				return fmt.Errorf(`"min_tls_version" is not supported for a Storage Account located in %q`, env.Name)
+			}
+		} else {
+			opts := storage.AccountUpdateParameters{
+				AccountPropertiesUpdateParameters: &storage.AccountPropertiesUpdateParameters{
+					MinimumTLSVersion: storage.MinimumTLSVersion(minimumTLSVersion),
+				},
+			}
 
-		if _, err := client.Update(ctx, resourceGroupName, storageAccountName, opts); err != nil {
-			return fmt.Errorf("Error updating Azure Storage Account min_tls_version %q: %+v", storageAccountName, err)
+			if _, err := client.Update(ctx, resourceGroupName, storageAccountName, opts); err != nil {
+				return fmt.Errorf("Error updating Azure Storage Account min_tls_version %q: %+v", storageAccountName, err)
+			}
 		}
 	}
 
 	if d.HasChange("allow_blob_public_access") {
 		allowBlobPublicAccess := d.Get("allow_blob_public_access").(bool)
 
-		opts := storage.AccountUpdateParameters{
-			AccountPropertiesUpdateParameters: &storage.AccountPropertiesUpdateParameters{
-				AllowBlobPublicAccess: &allowBlobPublicAccess,
-			},
-		}
+		// For US Government Cloud, don't specify "allow_blob_public_access" in request body.
+		// https://github.com/terraform-providers/terraform-provider-azurerm/issues/7812
+		if env.Name == autorestAzure.USGovernmentCloud.Name {
+			if allowBlobPublicAccess {
+				return fmt.Errorf(`"allow_blob_public_access" is not supported for a Storage Account located in %q`, env.Name)
+			}
+		} else {
+			opts := storage.AccountUpdateParameters{
+				AccountPropertiesUpdateParameters: &storage.AccountPropertiesUpdateParameters{
+					AllowBlobPublicAccess: &allowBlobPublicAccess,
+				},
+			}
 
-		if _, err := client.Update(ctx, resourceGroupName, storageAccountName, opts); err != nil {
-			return fmt.Errorf("Error updating Azure Storage Account allow_blob_public_access %q: %+v", storageAccountName, err)
+			if _, err := client.Update(ctx, resourceGroupName, storageAccountName, opts); err != nil {
+				return fmt.Errorf("Error updating Azure Storage Account allow_blob_public_access %q: %+v", storageAccountName, err)
+			}
 		}
 	}
 
@@ -1005,6 +1034,7 @@ func resourceArmStorageAccountUpdate(d *schema.ResourceData, meta interface{}) e
 }
 
 func resourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) error {
+	env := meta.(*clients.Client).Storage.Environment
 	client := meta.(*clients.Client).Storage.AccountsClient
 	endpointSuffix := meta.(*clients.Client).Account.Environment.StorageEndpointSuffix
 	ctx, cancel := timeouts.ForRead(meta.(*clients.Client).StopContext, d)
@@ -1066,9 +1096,14 @@ func resourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) err
 	if props := resp.AccountProperties; props != nil {
 		d.Set("access_tier", props.AccessTier)
 		d.Set("enable_https_traffic_only", props.EnableHTTPSTrafficOnly)
-		d.Set("min_tls_version", string(props.MinimumTLSVersion))
 		d.Set("is_hns_enabled", props.IsHnsEnabled)
-		d.Set("allow_blob_public_access", props.AllowBlobPublicAccess)
+		// For US Government Cloud, don't specify "allow_blob_public_access" and "min_tls_version" in request body.
+		// https://github.com/terraform-providers/terraform-provider-azurerm/issues/7812
+		// https://github.com/terraform-providers/terraform-provider-azurerm/issues/8083
+		if env.Name != autorestAzure.USGovernmentCloud.Name {
+			d.Set("allow_blob_public_access", props.AllowBlobPublicAccess)
+			d.Set("min_tls_version", string(props.MinimumTLSVersion))
+		}
 
 		if customDomain := props.CustomDomain; customDomain != nil {
 			if err := d.Set("custom_domain", flattenStorageAccountCustomDomain(customDomain)); err != nil {

website/docs/r/storage_account.html.markdown

@@ -99,8 +99,12 @@ The following arguments are supported:
 
 * `min_tls_version` - (Optional) The minimum supported TLS version for the storage account. Possible values are `TLS1_0`, `TLS1_1`, and `TLS1_2`. Defaults to `TLS1_0` for new storage accounts.
 
+-> **NOTE:** At this time `min_tls_version` is not supported in US Government.
+
 * `allow_blob_public_access` - Allow or disallow public access to all blobs or containers in the storage account. Defaults to `false`.
 
+-> **NOTE:** At this time `allow_blob_public_access` is not supported in US Government.
+
 * `is_hns_enabled` - (Optional) Is Hierarchical Namespace enabled? This can be used with Azure Data Lake Storage Gen 2 ([see here for more information](https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-quickstart-create-account/)). Changing this forces a new resource to be created. 
 
 -> **NOTE:** When this is set to `true` the `account_tier` argument must be set to `Standard`