Data Source: azurerm_storage_account - support for the azure_files_identity_based_auth property

internal/services/storage/storage_account_data_source.go

@@ -280,6 +280,51 @@ func dataSourceStorageAccount() *pluginsdk.Resource {
 				Computed: true,
 			},
 
+			"azure_files_authentication": {
+				Type:     pluginsdk.TypeList,
+				Computed: true,
+				Elem: &pluginsdk.Resource{
+					Schema: map[string]*pluginsdk.Schema{
+						"directory_type": {
+							Type:     pluginsdk.TypeString,
+							Computed: true,
+						},
+						"active_directory": {
+							Type:     pluginsdk.TypeList,
+							Computed: true,
+							Elem: &pluginsdk.Resource{
+								Schema: map[string]*pluginsdk.Schema{
+									"domain_name": {
+										Type:     pluginsdk.TypeString,
+										Computed: true,
+									},
+									"netbios_domain_name": {
+										Type:     pluginsdk.TypeString,
+										Computed: true,
+									},
+									"forest_name": {
+										Type:     pluginsdk.TypeString,
+										Computed: true,
+									},
+									"domain_guid": {
+										Type:     pluginsdk.TypeString,
+										Computed: true,
+									},
+									"domain_sid": {
+										Type:     pluginsdk.TypeString,
+										Computed: true,
+									},
+									"storage_sid": {
+										Type:     pluginsdk.TypeString,
+										Computed: true,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+
 			"tags": tags.SchemaDataSource(),
 		},
 	}
@@ -413,6 +458,10 @@ func dataSourceStorageAccountRead(d *pluginsdk.ResourceData, meta interface{}) e
 			infrastructureEncryption = *encryption.RequireInfrastructureEncryption
 		}
 		d.Set("infrastructure_encryption_enabled", infrastructureEncryption)
+
+		if err := d.Set("azure_files_authentication", flattenArmStorageAccountAzureFilesAuthentication(props.AzureFilesIdentityBasedAuthentication)); err != nil {
+			return fmt.Errorf("setting `azure_files_authentication`: %+v", err)
+		}
 	}
 
 	if accessKeys := keys.Keys; accessKeys != nil {

internal/services/storage/storage_account_data_source_test.go

@@ -139,6 +139,25 @@ func TestAccDataSourceStorageAccount_systemAssignedUserAssignedIdentity(t *testi
 	})
 }
 
+func TestAccDataSourceStorageAccount_azureFilesAuthentication(t *testing.T) {
+	data := acceptance.BuildTestData(t, "data.azurerm_storage_account", "test")
+
+	data.DataSourceTest(t, []acceptance.TestStep{
+		{
+			Config: StorageAccountDataSource{}.azureFilesAuthenticationAD(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).Key("azure_files_authentication.0.directory_type").HasValue("AD"),
+				check.That(data.ResourceName).Key("azure_files_authentication.0.active_directory.0.storage_sid").HasValue("S-1-5-21-2400535526-2334094090-2402026252-0012"),
+				check.That(data.ResourceName).Key("azure_files_authentication.0.active_directory.0.domain_name").HasValue("adtest.com"),
+				check.That(data.ResourceName).Key("azure_files_authentication.0.active_directory.0.domain_sid").HasValue("S-1-5-21-2400535526-2334094090-2402026252-0012"),
+				check.That(data.ResourceName).Key("azure_files_authentication.0.active_directory.0.domain_guid").HasValue("aebfc118-9fa9-4732-a21f-d98e41a77ae1"),
+				check.That(data.ResourceName).Key("azure_files_authentication.0.active_directory.0.forest_name").HasValue("adtest.com"),
+				check.That(data.ResourceName).Key("azure_files_authentication.0.active_directory.0.netbios_domain_name").HasValue("adtest.com"),
+			),
+		},
+	})
+}
+
 func (d StorageAccountDataSource) basic(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {
@@ -355,3 +374,41 @@ data "azurerm_storage_account" "test" {
 }
 `, d.identityTemplate(data), data.RandomString)
 }
+
+func (d StorageAccountDataSource) azureFilesAuthenticationAD(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-storage-%d"
+  location = "%s"
+}
+
+resource "azurerm_storage_account" "test" {
+  name                     = "unlikely23exst2acct%s"
+  resource_group_name      = azurerm_resource_group.test.name
+  location                 = azurerm_resource_group.test.location
+  account_tier             = "Standard"
+  account_replication_type = "LRS"
+
+  azure_files_authentication {
+    directory_type = "AD"
+    active_directory {
+      storage_sid         = "S-1-5-21-2400535526-2334094090-2402026252-0012"
+      domain_name         = "adtest.com"
+      domain_sid          = "S-1-5-21-2400535526-2334094090-2402026252-0012"
+      domain_guid         = "aebfc118-9fa9-4732-a21f-d98e41a77ae1"
+      forest_name         = "adtest.com"
+      netbios_domain_name = "adtest.com"
+    }
+  }
+}
+
+data "azurerm_storage_account" "test" {
+  name                = azurerm_storage_account.test.name
+  resource_group_name = azurerm_storage_account.test.resource_group_name
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomString)
+}

website/docs/d/storage_account.html.markdown

@@ -132,6 +132,8 @@ output "storage_account_tier" {
 
 * `infrastructure_encryption_enabled` - Is infrastructure encryption enabled? See [here](https://docs.microsoft.com/azure/storage/common/infrastructure-encryption-enable/)
     for more information.
+
+* `azure_files_authentication` - A `azure_files_authentication` block as documented below.
 ---
 
 * `custom_domain` supports the following:
@@ -150,6 +152,30 @@ output "storage_account_tier" {
 
 * `tenant_id` - The Tenant ID for the Service Principal associated with the Identity of this Storage Account.
 
+---
+
+`azure_files_authentication` supports the following:
+
+* `directory_type` - The directory service used for this Storage Account.
+
+* `active_directory` - An `active_directory` block as documented below.
+
+---
+
+`active_directory` supports the following:
+
+* `domain_name` - The primary domain that the AD DNS server is authoritative for.
+
+* `netbios_domain_name` - The NetBIOS domain name.
+
+* `forest_name` - The name of the Active Directory forest.
+
+* `domain_guid` - The domain GUID.
+
+* `domain_sid` - The domain security identifier.
+
+* `storage_sid` - The security identifier for Azure Storage.
+
 ## Timeouts
 
 The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions: