customerManagedKey.go

// Code generated by the Pulumi Terraform Bridge (tfgen) Tool DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package storage

import (
	"context"
	"reflect"

	"errors"
	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/internal"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// Manages a Customer Managed Key for a Storage Account.
//
// > **NOTE:** It's possible to define a Customer Managed Key both within the `storage.Account` resource via the `customerManagedKey` block and by using the `storage.CustomerManagedKey` resource. However it's not possible to use both methods to manage a Customer Managed Key for a Storage Account, since there'll be conflicts.
//
// ## Example Usage
//
// ```go
// package main
//
// import (
//
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/keyvault"
//	"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/storage"
//	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
//
// )
//
//	func main() {
//		pulumi.Run(func(ctx *pulumi.Context) error {
//			current, err := core.GetClientConfig(ctx, nil, nil)
//			if err != nil {
//				return err
//			}
//			example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
//				Name:     pulumi.String("example-resources"),
//				Location: pulumi.String("West Europe"),
//			})
//			if err != nil {
//				return err
//			}
//			exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
//				Name:                   pulumi.String("examplekv"),
//				Location:               example.Location,
//				ResourceGroupName:      example.Name,
//				TenantId:               pulumi.String(current.TenantId),
//				SkuName:                pulumi.String("standard"),
//				PurgeProtectionEnabled: pulumi.Bool(true),
//			})
//			if err != nil {
//				return err
//			}
//			exampleAccount, err := storage.NewAccount(ctx, "example", &storage.AccountArgs{
//				Name:                   pulumi.String("examplestor"),
//				ResourceGroupName:      example.Name,
//				Location:               example.Location,
//				AccountTier:            pulumi.String("Standard"),
//				AccountReplicationType: pulumi.String("GRS"),
//				Identity: &storage.AccountIdentityArgs{
//					Type: pulumi.String("SystemAssigned"),
//				},
//			})
//			if err != nil {
//				return err
//			}
//			_, err = keyvault.NewAccessPolicy(ctx, "storage", &keyvault.AccessPolicyArgs{
//				KeyVaultId: exampleKeyVault.ID(),
//				TenantId:   pulumi.String(current.TenantId),
//				ObjectId: exampleAccount.Identity.ApplyT(func(identity storage.AccountIdentity) (*string, error) {
//					return &identity.PrincipalId, nil
//				}).(pulumi.StringPtrOutput),
//				SecretPermissions: pulumi.StringArray{
//					pulumi.String("Get"),
//				},
//				KeyPermissions: pulumi.StringArray{
//					pulumi.String("Get"),
//					pulumi.String("UnwrapKey"),
//					pulumi.String("WrapKey"),
//				},
//			})
//			if err != nil {
//				return err
//			}
//			_, err = keyvault.NewAccessPolicy(ctx, "client", &keyvault.AccessPolicyArgs{
//				KeyVaultId: exampleKeyVault.ID(),
//				TenantId:   pulumi.String(current.TenantId),
//				ObjectId:   pulumi.String(current.ObjectId),
//				SecretPermissions: pulumi.StringArray{
//					pulumi.String("Get"),
//				},
//				KeyPermissions: pulumi.StringArray{
//					pulumi.String("Get"),
//					pulumi.String("Create"),
//					pulumi.String("Delete"),
//					pulumi.String("List"),
//					pulumi.String("Restore"),
//					pulumi.String("Recover"),
//					pulumi.String("UnwrapKey"),
//					pulumi.String("WrapKey"),
//					pulumi.String("Purge"),
//					pulumi.String("Encrypt"),
//					pulumi.String("Decrypt"),
//					pulumi.String("Sign"),
//					pulumi.String("Verify"),
//					pulumi.String("GetRotationPolicy"),
//					pulumi.String("SetRotationPolicy"),
//				},
//			})
//			if err != nil {
//				return err
//			}
//			exampleKey, err := keyvault.NewKey(ctx, "example", &keyvault.KeyArgs{
//				Name:       pulumi.String("tfex-key"),
//				KeyVaultId: exampleKeyVault.ID(),
//				KeyType:    pulumi.String("RSA"),
//				KeySize:    pulumi.Int(2048),
//				KeyOpts: pulumi.StringArray{
//					pulumi.String("decrypt"),
//					pulumi.String("encrypt"),
//					pulumi.String("sign"),
//					pulumi.String("unwrapKey"),
//					pulumi.String("verify"),
//					pulumi.String("wrapKey"),
//				},
//			})
//			if err != nil {
//				return err
//			}
//			_, err = storage.NewCustomerManagedKey(ctx, "example", &storage.CustomerManagedKeyArgs{
//				StorageAccountId: exampleAccount.ID(),
//				KeyVaultId:       exampleKeyVault.ID(),
//				KeyName:          exampleKey.Name,
//			})
//			if err != nil {
//				return err
//			}
//			return nil
//		})
//	}
//
// ```
//
// ## Import
//
// Customer Managed Keys for a Storage Account can be imported using the `resource id` of the Storage Account, e.g.
//
// ```sh
// $ pulumi import azure:storage/customerManagedKey:CustomerManagedKey example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myresourcegroup/providers/Microsoft.Storage/storageAccounts/myaccount
// ```
type CustomerManagedKey struct {
	pulumi.CustomResourceState

	// The Client ID of the multi-tenant application to be used in conjunction with the user-assigned identity for cross-tenant customer-managed-keys server-side encryption on the storage account.
	FederatedIdentityClientId pulumi.StringPtrOutput `pulumi:"federatedIdentityClientId"`
	// The name of Key Vault Key.
	KeyName    pulumi.StringOutput    `pulumi:"keyName"`
	KeyVaultId pulumi.StringPtrOutput `pulumi:"keyVaultId"`
	// URI pointing at the Key Vault. Required when using `federatedIdentityClientId`. Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	KeyVaultUri pulumi.StringOutput `pulumi:"keyVaultUri"`
	// The version of Key Vault Key. Remove or omit this argument to enable Automatic Key Rotation.
	KeyVersion pulumi.StringPtrOutput `pulumi:"keyVersion"`
	// Key ID of a key in a managed HSM.  Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	ManagedHsmKeyId pulumi.StringPtrOutput `pulumi:"managedHsmKeyId"`
	// The ID of the Storage Account. Changing this forces a new resource to be created.
	StorageAccountId pulumi.StringOutput `pulumi:"storageAccountId"`
	// The ID of a user assigned identity.
	UserAssignedIdentityId pulumi.StringPtrOutput `pulumi:"userAssignedIdentityId"`
}

// NewCustomerManagedKey registers a new resource with the given unique name, arguments, and options.
func NewCustomerManagedKey(ctx *pulumi.Context,
	name string, args *CustomerManagedKeyArgs, opts ...pulumi.ResourceOption) (*CustomerManagedKey, error) {
	if args == nil {
		return nil, errors.New("missing one or more required arguments")
	}

	if args.KeyName == nil {
		return nil, errors.New("invalid value for required argument 'KeyName'")
	}
	if args.StorageAccountId == nil {
		return nil, errors.New("invalid value for required argument 'StorageAccountId'")
	}
	opts = internal.PkgResourceDefaultOpts(opts)
	var resource CustomerManagedKey
	err := ctx.RegisterResource("azure:storage/customerManagedKey:CustomerManagedKey", name, args, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// GetCustomerManagedKey gets an existing CustomerManagedKey resource's state with the given name, ID, and optional
// state properties that are used to uniquely qualify the lookup (nil if not required).
func GetCustomerManagedKey(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *CustomerManagedKeyState, opts ...pulumi.ResourceOption) (*CustomerManagedKey, error) {
	var resource CustomerManagedKey
	err := ctx.ReadResource("azure:storage/customerManagedKey:CustomerManagedKey", name, id, state, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// Input properties used for looking up and filtering CustomerManagedKey resources.
type customerManagedKeyState struct {
	// The Client ID of the multi-tenant application to be used in conjunction with the user-assigned identity for cross-tenant customer-managed-keys server-side encryption on the storage account.
	FederatedIdentityClientId *string `pulumi:"federatedIdentityClientId"`
	// The name of Key Vault Key.
	KeyName    *string `pulumi:"keyName"`
	KeyVaultId *string `pulumi:"keyVaultId"`
	// URI pointing at the Key Vault. Required when using `federatedIdentityClientId`. Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	KeyVaultUri *string `pulumi:"keyVaultUri"`
	// The version of Key Vault Key. Remove or omit this argument to enable Automatic Key Rotation.
	KeyVersion *string `pulumi:"keyVersion"`
	// Key ID of a key in a managed HSM.  Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	ManagedHsmKeyId *string `pulumi:"managedHsmKeyId"`
	// The ID of the Storage Account. Changing this forces a new resource to be created.
	StorageAccountId *string `pulumi:"storageAccountId"`
	// The ID of a user assigned identity.
	UserAssignedIdentityId *string `pulumi:"userAssignedIdentityId"`
}

type CustomerManagedKeyState struct {
	// The Client ID of the multi-tenant application to be used in conjunction with the user-assigned identity for cross-tenant customer-managed-keys server-side encryption on the storage account.
	FederatedIdentityClientId pulumi.StringPtrInput
	// The name of Key Vault Key.
	KeyName    pulumi.StringPtrInput
	KeyVaultId pulumi.StringPtrInput
	// URI pointing at the Key Vault. Required when using `federatedIdentityClientId`. Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	KeyVaultUri pulumi.StringPtrInput
	// The version of Key Vault Key. Remove or omit this argument to enable Automatic Key Rotation.
	KeyVersion pulumi.StringPtrInput
	// Key ID of a key in a managed HSM.  Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	ManagedHsmKeyId pulumi.StringPtrInput
	// The ID of the Storage Account. Changing this forces a new resource to be created.
	StorageAccountId pulumi.StringPtrInput
	// The ID of a user assigned identity.
	UserAssignedIdentityId pulumi.StringPtrInput
}

func (CustomerManagedKeyState) ElementType() reflect.Type {
	return reflect.TypeOf((*customerManagedKeyState)(nil)).Elem()
}

type customerManagedKeyArgs struct {
	// The Client ID of the multi-tenant application to be used in conjunction with the user-assigned identity for cross-tenant customer-managed-keys server-side encryption on the storage account.
	FederatedIdentityClientId *string `pulumi:"federatedIdentityClientId"`
	// The name of Key Vault Key.
	KeyName    string  `pulumi:"keyName"`
	KeyVaultId *string `pulumi:"keyVaultId"`
	// URI pointing at the Key Vault. Required when using `federatedIdentityClientId`. Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	KeyVaultUri *string `pulumi:"keyVaultUri"`
	// The version of Key Vault Key. Remove or omit this argument to enable Automatic Key Rotation.
	KeyVersion *string `pulumi:"keyVersion"`
	// Key ID of a key in a managed HSM.  Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	ManagedHsmKeyId *string `pulumi:"managedHsmKeyId"`
	// The ID of the Storage Account. Changing this forces a new resource to be created.
	StorageAccountId string `pulumi:"storageAccountId"`
	// The ID of a user assigned identity.
	UserAssignedIdentityId *string `pulumi:"userAssignedIdentityId"`
}

// The set of arguments for constructing a CustomerManagedKey resource.
type CustomerManagedKeyArgs struct {
	// The Client ID of the multi-tenant application to be used in conjunction with the user-assigned identity for cross-tenant customer-managed-keys server-side encryption on the storage account.
	FederatedIdentityClientId pulumi.StringPtrInput
	// The name of Key Vault Key.
	KeyName    pulumi.StringInput
	KeyVaultId pulumi.StringPtrInput
	// URI pointing at the Key Vault. Required when using `federatedIdentityClientId`. Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	KeyVaultUri pulumi.StringPtrInput
	// The version of Key Vault Key. Remove or omit this argument to enable Automatic Key Rotation.
	KeyVersion pulumi.StringPtrInput
	// Key ID of a key in a managed HSM.  Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
	ManagedHsmKeyId pulumi.StringPtrInput
	// The ID of the Storage Account. Changing this forces a new resource to be created.
	StorageAccountId pulumi.StringInput
	// The ID of a user assigned identity.
	UserAssignedIdentityId pulumi.StringPtrInput
}

func (CustomerManagedKeyArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*customerManagedKeyArgs)(nil)).Elem()
}

type CustomerManagedKeyInput interface {
	pulumi.Input

	ToCustomerManagedKeyOutput() CustomerManagedKeyOutput
	ToCustomerManagedKeyOutputWithContext(ctx context.Context) CustomerManagedKeyOutput
}

func (*CustomerManagedKey) ElementType() reflect.Type {
	return reflect.TypeOf((**CustomerManagedKey)(nil)).Elem()
}

func (i *CustomerManagedKey) ToCustomerManagedKeyOutput() CustomerManagedKeyOutput {
	return i.ToCustomerManagedKeyOutputWithContext(context.Background())
}

func (i *CustomerManagedKey) ToCustomerManagedKeyOutputWithContext(ctx context.Context) CustomerManagedKeyOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CustomerManagedKeyOutput)
}

// CustomerManagedKeyArrayInput is an input type that accepts CustomerManagedKeyArray and CustomerManagedKeyArrayOutput values.
// You can construct a concrete instance of `CustomerManagedKeyArrayInput` via:
//
//	CustomerManagedKeyArray{ CustomerManagedKeyArgs{...} }
type CustomerManagedKeyArrayInput interface {
	pulumi.Input

	ToCustomerManagedKeyArrayOutput() CustomerManagedKeyArrayOutput
	ToCustomerManagedKeyArrayOutputWithContext(context.Context) CustomerManagedKeyArrayOutput
}

type CustomerManagedKeyArray []CustomerManagedKeyInput

func (CustomerManagedKeyArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*CustomerManagedKey)(nil)).Elem()
}

func (i CustomerManagedKeyArray) ToCustomerManagedKeyArrayOutput() CustomerManagedKeyArrayOutput {
	return i.ToCustomerManagedKeyArrayOutputWithContext(context.Background())
}

func (i CustomerManagedKeyArray) ToCustomerManagedKeyArrayOutputWithContext(ctx context.Context) CustomerManagedKeyArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CustomerManagedKeyArrayOutput)
}

// CustomerManagedKeyMapInput is an input type that accepts CustomerManagedKeyMap and CustomerManagedKeyMapOutput values.
// You can construct a concrete instance of `CustomerManagedKeyMapInput` via:
//
//	CustomerManagedKeyMap{ "key": CustomerManagedKeyArgs{...} }
type CustomerManagedKeyMapInput interface {
	pulumi.Input

	ToCustomerManagedKeyMapOutput() CustomerManagedKeyMapOutput
	ToCustomerManagedKeyMapOutputWithContext(context.Context) CustomerManagedKeyMapOutput
}

type CustomerManagedKeyMap map[string]CustomerManagedKeyInput

func (CustomerManagedKeyMap) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*CustomerManagedKey)(nil)).Elem()
}

func (i CustomerManagedKeyMap) ToCustomerManagedKeyMapOutput() CustomerManagedKeyMapOutput {
	return i.ToCustomerManagedKeyMapOutputWithContext(context.Background())
}

func (i CustomerManagedKeyMap) ToCustomerManagedKeyMapOutputWithContext(ctx context.Context) CustomerManagedKeyMapOutput {
	return pulumi.ToOutputWithContext(ctx, i).(CustomerManagedKeyMapOutput)
}

type CustomerManagedKeyOutput struct{ *pulumi.OutputState }

func (CustomerManagedKeyOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**CustomerManagedKey)(nil)).Elem()
}

func (o CustomerManagedKeyOutput) ToCustomerManagedKeyOutput() CustomerManagedKeyOutput {
	return o
}

func (o CustomerManagedKeyOutput) ToCustomerManagedKeyOutputWithContext(ctx context.Context) CustomerManagedKeyOutput {
	return o
}

// The Client ID of the multi-tenant application to be used in conjunction with the user-assigned identity for cross-tenant customer-managed-keys server-side encryption on the storage account.
func (o CustomerManagedKeyOutput) FederatedIdentityClientId() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringPtrOutput { return v.FederatedIdentityClientId }).(pulumi.StringPtrOutput)
}

// The name of Key Vault Key.
func (o CustomerManagedKeyOutput) KeyName() pulumi.StringOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringOutput { return v.KeyName }).(pulumi.StringOutput)
}

func (o CustomerManagedKeyOutput) KeyVaultId() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringPtrOutput { return v.KeyVaultId }).(pulumi.StringPtrOutput)
}

// URI pointing at the Key Vault. Required when using `federatedIdentityClientId`. Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
func (o CustomerManagedKeyOutput) KeyVaultUri() pulumi.StringOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringOutput { return v.KeyVaultUri }).(pulumi.StringOutput)
}

// The version of Key Vault Key. Remove or omit this argument to enable Automatic Key Rotation.
func (o CustomerManagedKeyOutput) KeyVersion() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringPtrOutput { return v.KeyVersion }).(pulumi.StringPtrOutput)
}

// Key ID of a key in a managed HSM.  Exactly one of `managedHsmKeyId`, `keyVaultId`, or `keyVaultUri` must be specified.
func (o CustomerManagedKeyOutput) ManagedHsmKeyId() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringPtrOutput { return v.ManagedHsmKeyId }).(pulumi.StringPtrOutput)
}

// The ID of the Storage Account. Changing this forces a new resource to be created.
func (o CustomerManagedKeyOutput) StorageAccountId() pulumi.StringOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringOutput { return v.StorageAccountId }).(pulumi.StringOutput)
}

// The ID of a user assigned identity.
func (o CustomerManagedKeyOutput) UserAssignedIdentityId() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *CustomerManagedKey) pulumi.StringPtrOutput { return v.UserAssignedIdentityId }).(pulumi.StringPtrOutput)
}

type CustomerManagedKeyArrayOutput struct{ *pulumi.OutputState }

func (CustomerManagedKeyArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*CustomerManagedKey)(nil)).Elem()
}

func (o CustomerManagedKeyArrayOutput) ToCustomerManagedKeyArrayOutput() CustomerManagedKeyArrayOutput {
	return o
}

func (o CustomerManagedKeyArrayOutput) ToCustomerManagedKeyArrayOutputWithContext(ctx context.Context) CustomerManagedKeyArrayOutput {
	return o
}

func (o CustomerManagedKeyArrayOutput) Index(i pulumi.IntInput) CustomerManagedKeyOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) *CustomerManagedKey {
		return vs[0].([]*CustomerManagedKey)[vs[1].(int)]
	}).(CustomerManagedKeyOutput)
}

type CustomerManagedKeyMapOutput struct{ *pulumi.OutputState }

func (CustomerManagedKeyMapOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*CustomerManagedKey)(nil)).Elem()
}

func (o CustomerManagedKeyMapOutput) ToCustomerManagedKeyMapOutput() CustomerManagedKeyMapOutput {
	return o
}

func (o CustomerManagedKeyMapOutput) ToCustomerManagedKeyMapOutputWithContext(ctx context.Context) CustomerManagedKeyMapOutput {
	return o
}

func (o CustomerManagedKeyMapOutput) MapIndex(k pulumi.StringInput) CustomerManagedKeyOutput {
	return pulumi.All(o, k).ApplyT(func(vs []interface{}) *CustomerManagedKey {
		return vs[0].(map[string]*CustomerManagedKey)[vs[1].(string)]
	}).(CustomerManagedKeyOutput)
}

func init() {
	pulumi.RegisterInputType(reflect.TypeOf((*CustomerManagedKeyInput)(nil)).Elem(), &CustomerManagedKey{})
	pulumi.RegisterInputType(reflect.TypeOf((*CustomerManagedKeyArrayInput)(nil)).Elem(), CustomerManagedKeyArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*CustomerManagedKeyMapInput)(nil)).Elem(), CustomerManagedKeyMap{})
	pulumi.RegisterOutputType(CustomerManagedKeyOutput{})
	pulumi.RegisterOutputType(CustomerManagedKeyArrayOutput{})
	pulumi.RegisterOutputType(CustomerManagedKeyMapOutput{})
}