azurerm_storage_account_customer_managed_key - support for cross-tenant customer-managed keys

[Sewci0]

Adds support for Cross Tenant CMK

https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-cross-tenant-new-account

Introduces two new properties:

• key_vault_uri - used when the SP has no access to the vault that stores the CMK
• federated_identity_client_id - points at the appID used for federated access

[magodo]

Thanks for this PR!
I've taken a look through and left some comments inline. Meanwhile, there needs one/more acctests to cover this new change.

[Sewci0]

Thank you @magodo for looking into it, I've replied to your comment and fixed the rest of the issues.

I've also added acceptance tests but these are super tricky to run as you need to set up two separate tenants.

[magodo]

@Sewci0 Thank you for the update! It now LGTM!

[katbyte]

We have some test failures:

------- Stdout: -------
=== RUN   TestAccStorageAccountCustomerManagedKey_updateKey
=== PAUSE TestAccStorageAccountCustomerManagedKey_updateKey
=== CONT  TestAccStorageAccountCustomerManagedKey_updateKey
    testcase.go:110: Step 1/4 error: After applying this test step, the plan was not empty.
        stdout:
        
        
        Terraform used the selected providers to generate the following execution
        plan. Resource actions are indicated with the following symbols:
          ~ update in-place
        
        Terraform will perform the following actions:
        
          # azurerm_storage_account_customer_managed_key.test will be updated in-place
          ~ resource "azurerm_storage_account_customer_managed_key" "test" {
                id                 = "/subscriptions/*******/resourceGroups/acctestRG-230224173716578224/providers/Microsoft.Storage/storageAccounts/acctestsai40tk"
              - key_vault_uri      = "https://acctestkvi40tk.vault.azure.net/" -> null
                # (4 unchanged attributes hidden)
            }
        
        Plan: 0 to add, 1 to change, 0 to destroy.
--- FAIL: TestAccStorageAccountCustomerManagedKey_updateKey (380.72s)
FAIL

[vaishakhbn]

Hi, do you know if this PR is being actively worked on?

[Sewci0]

Hi @magodo, apologies it has taken so long but I've just fixed the tests and rerun them locally. It should be ready to go. Thanks!

[msmygit]

@tombuildsstuff @magodo @manicminer -- any idea if this PR is being looked at activtely and will be incorporated? This has been pending for quite a long time now with more and more people awaiting its release. Thank you in advance!

[manicminer]

@Sewci0 Thank you for keeping the branch updated and for your patience whilst we update our testing infrastructure. I've pushed a few minor changes to the test config and it LGTM!

Since I've updated our TeamCity configuration, I'll let another maintainer look over those changes before merging.

[manicminer]

TeamCity config changes for additional review: 707a94b

Changes made

[stephybun]

Tests look good. Thanks for this @Sewci0 and @manicminer! LGTM 🎉

[Sewci0]

@manicminer This is very exciting. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.