azurerm_data_protection_backup_vault : support soft_delete and retention_duration_in_days properties

internal/services/dataprotection/data_protection_backup_vault_resource.go

@@ -4,6 +4,7 @@
 package dataprotection
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"regexp"
@@ -72,8 +73,35 @@ func resourceDataProtectionBackupVault() *pluginsdk.Resource {
 
 			"identity": commonschema.SystemAssignedIdentityOptional(),
 
+			"retention_duration_in_days": {
+				Type:         pluginsdk.TypeFloat,
+				Optional:     true,
+				ValidateFunc: validation.FloatBetween(14, 180),
+			},
+
+			"soft_delete_setting": {
+				Type:         pluginsdk.TypeString,
+				Optional:     true,
+				Default:      backupvaults.SoftDeleteStateOn,
+				ValidateFunc: validation.StringInSlice(backupvaults.PossibleValuesForSoftDeleteState(), false),
+			},
+
 			"tags": tags.Schema(),
 		},
+
+		CustomizeDiff: pluginsdk.CustomDiffWithAll(
+			pluginsdk.ForceNewIfChange("soft_delete_setting", func(ctx context.Context, old, new, meta interface{}) bool {
+				return old.(string) == string(backupvaults.SoftDeleteStateAlwaysOn) && new.(string) != string(backupvaults.SoftDeleteStateAlwaysOn)
+			}),
+			pluginsdk.CustomizeDiffShim(func(ctx context.Context, d *pluginsdk.ResourceDiff, v interface{}) error {
+				state := d.Get("soft_delete_setting").(string)
+				_, ok := d.GetOk("retention_duration_in_days")
+				if state == string(backupvaults.SoftDeleteStateOn) && !ok {
+					return fmt.Errorf("`retention_duration_in_days` is required when the `soft_delete_setting` is `On`")
+				}
+				return nil
+			}),
+		),
 	}
 
 	// Confirmed with the service team that `SnapshotStore` has been replaced with `OperationalStore`.
@@ -144,10 +172,20 @@ func resourceDataProtectionBackupVaultCreateUpdate(d *pluginsdk.ResourceData, me
 					Type:          &storageSettingType,
 				},
 			},
+			SecuritySettings: &backupvaults.SecuritySettings{
+				SoftDeleteSettings: &backupvaults.SoftDeleteSettings{
+					State: pointer.To(backupvaults.SoftDeleteState(d.Get("soft_delete_setting").(string))),
+				},
+			},
 		},
 		Identity: expandedIdentity,
 		Tags:     expandTags(d.Get("tags").(map[string]interface{})),
 	}
+
+	if v, ok := d.GetOk("retention_duration_in_days"); ok {
+		parameters.Properties.SecuritySettings.SoftDeleteSettings.RetentionDurationInDays = pointer.To(v.(float64))
+	}
+
 	err = client.CreateOrUpdateThenPoll(ctx, id, parameters)
 	if err != nil {
 		return fmt.Errorf("creating DataProtection BackupVault (%q): %+v", id, err)
@@ -186,6 +224,12 @@ func resourceDataProtectionBackupVaultRead(d *pluginsdk.ResourceData, meta inter
 			d.Set("datastore_type", string(pointer.From((props.StorageSettings)[0].DatastoreType)))
 			d.Set("redundancy", string(pointer.From((props.StorageSettings)[0].Type)))
 		}
+		if securitySetting := model.Properties.SecuritySettings; securitySetting != nil {
+			if softDelete := securitySetting.SoftDeleteSettings; softDelete != nil {
+				d.Set("soft_delete_setting", string(pointer.From(softDelete.State)))
+				d.Set("retention_duration_in_days", pointer.From(softDelete.RetentionDurationInDays))
+			}
+		}
 
 		if err = d.Set("identity", flattenBackupVaultDppIdentityDetails(model.Identity)); err != nil {
 			return fmt.Errorf("setting `identity`: %+v", err)

internal/services/dataprotection/data_protection_backup_vault_resource_test.go

@@ -93,6 +93,13 @@ func TestAccDataProtectionBackupVault_update(t *testing.T) {
 			),
 		},
 		data.ImportStep(),
+		{
+			Config: r.completeUpdate(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep(),
 		{
 			Config: r.basic(data),
 			Check: acceptance.ComposeTestCheckFunc(
@@ -167,6 +174,7 @@ resource "azurerm_data_protection_backup_vault" "test" {
   location            = azurerm_resource_group.test.location
   datastore_type      = "VaultStore"
   redundancy          = "LocallyRedundant"
+  soft_delete_setting = "Off"
 }
 `, template, data.RandomInteger)
 }
@@ -182,6 +190,7 @@ resource "azurerm_data_protection_backup_vault" "import" {
   location            = azurerm_data_protection_backup_vault.test.location
   datastore_type      = azurerm_data_protection_backup_vault.test.datastore_type
   redundancy          = azurerm_data_protection_backup_vault.test.redundancy
+  soft_delete_setting = azurerm_data_protection_backup_vault.test.soft_delete_setting
 }
 `, config)
 }
@@ -200,7 +209,31 @@ resource "azurerm_data_protection_backup_vault" "test" {
   identity {
     type = "SystemAssigned"
   }
+  soft_delete_setting        = "On"
+  retention_duration_in_days = 14
+  tags = {
+    ENV = "Test"
+  }
+}
+`, template, data.RandomInteger)
+}
+
+func (r DataProtectionBackupVaultResource) completeUpdate(data acceptance.TestData) string {
+	template := r.template(data)
+	return fmt.Sprintf(`
+%s
 
+resource "azurerm_data_protection_backup_vault" "test" {
+  name                = "acctest-bv-%d"
+  resource_group_name = azurerm_resource_group.test.name
+  location            = azurerm_resource_group.test.location
+  datastore_type      = "VaultStore"
+  redundancy          = "LocallyRedundant"
+  identity {
+    type = "SystemAssigned"
+  }
+  soft_delete_setting        = "On"
+  retention_duration_in_days = 15
   tags = {
     ENV = "Test"
   }
@@ -219,7 +252,7 @@ resource "azurerm_data_protection_backup_vault" "test" {
   location            = azurerm_resource_group.test.location
   datastore_type      = "VaultStore"
   redundancy          = "LocallyRedundant"
-
+  soft_delete_setting = "Off"
   tags = {
     ENV = "Test"
   }
@@ -238,6 +271,7 @@ resource "azurerm_data_protection_backup_vault" "test" {
   location            = azurerm_resource_group.test.location
   datastore_type      = "VaultStore"
   redundancy          = "ZoneRedundant"
+  soft_delete_setting = "Off"
 }
 `, template, data.RandomInteger)
 }

website/docs/r/data_protection_backup_vault.html.markdown

@@ -47,6 +47,14 @@ The following arguments are supported:
 
 * `identity` - (Optional) An `identity` block as defined below.
 
+* `retention_duration_in_days` - (Optional) The soft delete retention duration for this Backup Vault. Possible values are between `14` and `180`.
+
+-> **Note:** The `retention_duration_in_days` is the number of days for which deleted data is retained before being permanently deleted. Retention period till 14 days are free of cost, however, retention beyond 14 days may incur additional charges. The `retention_duration_in_days` is required when the `soft_delete_setting` is set to `On`.
+
+* `soft_delete_setting` - (Optional) The state of soft delete for this Backup Vault. Possible values are `AlwaysOn`, `Off` and `On`. Defaults to `On`.
+
+-> **Note:** Once the `soft_delete_setting` is set to `AlwaysOn`, the setting cannot be changed.
+
 * `tags` - (Optional) A mapping of tags which should be assigned to the Backup Vault.
 
 ---