New resource: `azurerm_key_vault_managed_hardware_security_module_key_rotation_policy` #27306

wuxu92 · 2024-09-06T11:27:35Z

Community Note

Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

Add key rotation policy support for Managed HSM Keys. Since this based on a Data plane API, I created a New resource for it instead of integrating into the Managed HSM Key resource. Based on my test, notification is not supported in MHSM Key. There is only one rotate policy for each key and there is no separation resource/id for it, so the new resource just resuse the managed hsm key id as its resource id.

https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/key-rotation

Given that creating a Managed HSM resource is a heavy operation, I created only one AccTest with both basic and update included. The creation/update of the rotation policy is fast.

PR Checklist

I have followed the guidelines in our Contributing Documentation.
I have checked to ensure there aren't other open Pull Requests for the same update/change.
I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
I have written new tests for my resource or datasource changes & updated any relevent documentation.
I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
(For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

--- PASS: TestAccMHSMKeyRotationPolicy_all (2749.04s)
PASS

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

azurerm_key_vault_managed_hardware_security_module_key_rotation_policy - New resource for Managed HSM Key rotation policy

This is a (please select all that apply):

Bug Fix
New Feature (ie adding a service, resource, or data source)
Enhancement
Breaking Change

Related Issue(s)

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

katbyte · 2024-09-13T02:43:28Z

website/docs/r/key_vault_managed_hardware_security_module_key_rotation_policy.html.markdown

+
+The following arguments are supported:
+
+* `expire_after` - (Required) Specify the expiration time of the key.


is this a date? a duration? what format?

Suggested change

* `expire_after` - (Required) Specify the expiration time of the key.

* `expire_after_date` - (Required) Specify the expiration time of the key.

Suggested change

* `expire_after` - (Required) Specify the expiration time of the key.

* `expire_after_duration` - (Required) Specify the expiration time of the key.

please detail what this actually means, is it related to the lifecycle actions/trigger not the key?

Updated the description and kept the name unchanged to align with the key vault rotation policy schema.

katbyte · 2024-09-13T02:44:06Z

website/docs/r/key_vault_managed_hardware_security_module_key_rotation_policy.html.markdown

+
+---
+


why is this sperator here?

katbyte · 2024-09-13T02:46:11Z

...rvices/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource.go

+			_, err = client.GetKey(ctx, keyID.BaseUri(), keyID.KeyName, "")
+			if err != nil {


these lines can be merged

...rvices/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource.go

katbyte · 2024-09-13T02:48:18Z

...rvices/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource.go

+func flattenKeyRotationPolicy(p keyvault.KeyRotationPolicy) MHSMKeyRotationPolicyResourceSchema {
+	var res MHSMKeyRotationPolicyResourceSchema
+	if p.Attributes != nil {
+		res.ExipreAfter = pointer.From(p.Attributes.ExpiryTime)


what does this expire? what happens ?

as documentation specified this is to set the key expiry after create/rotation.

website/docs/r/key_vault_managed_hardware_security_module_key_rotation_policy.html.markdown

jackofallops

Hi @wuxu92 - Just a couple of additional comments to @katbyte 's review to take a look at.

jackofallops · 2024-09-13T05:40:10Z

...rvices/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource.go

+
+	var expiryTime *string // = nil // needs to be set to nil if not set
+	if policy.ExipreAfter != "" {
+		expiryTime = utils.String(policy.ExipreAfter)


Can we not use the utils package here as we're deprecating these functions, and instead use the pointer package as you have done in the flatten below?

Suggested change

expiryTime = utils.String(policy.ExipreAfter)

expiryTime = pointer.To(policy.ExipreAfter)

jackofallops · 2024-09-13T05:42:49Z

...s/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource_test.go

+type MHSMKeyRotationPolicyTestResource struct{}
+
+func testAccMHSMKeyRotationPolicy_all(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_key_vault_managed_hardware_security_module_key", "test")


This is the wrong resource here?

Suggested change

data := acceptance.BuildTestData(t, "azurerm_key_vault_managed_hardware_security_module_key", "test")

data := acceptance.BuildTestData(t, "azurerm_key_vault_managed_hardware_security_module_key_rotation_policy", "test")

jackofallops

Thanks for the updates @wuxu92 - Spotted a couple typos and whitespace items if you can take a look, then I think we should be good to run the test.

jackofallops · 2024-09-16T06:39:20Z

...rvices/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource.go

+				return err
+			}
+
+			// settign a blank policy to delete the existing policy


Suggested change

// settign a blank policy to delete the existing policy

// setting a blank policy to delete the existing policy

jackofallops · 2024-09-16T06:41:45Z

...rvices/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource.go

+
+type MHSMKeyRotationPolicyResourceSchema struct {
+	ManagedHSMKeyID   string `tfschema:"managed_hsm_key_id"`
+	ExipreAfter       string `tfschema:"expire_after"`


Typo here

Suggested change

ExipreAfter string `tfschema:"expire_after"`

ExpireAfter string `tfschema:"expire_after"`

jackofallops · 2024-09-16T06:48:20Z

...s/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource_test.go

+
+
+
+


unnecessary whitespace here?

Suggested change

format issues of acc test fixed. can we add this to the terrafmt linter?

jackofallops · 2024-09-16T06:48:35Z

...s/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource_test.go

+}
+resource "azurerm_key_vault_managed_hardware_security_module" "test" {


Suggested change

}

resource "azurerm_key_vault_managed_hardware_security_module" "test" {

}

resource "azurerm_key_vault_managed_hardware_security_module" "test" {

jackofallops · 2024-09-16T06:49:03Z

...s/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource_test.go

+
+

unnecessary whitespace here?

Suggested change

jackofallops · 2024-09-16T06:49:26Z

...s/managedhsm/key_vault_managed_hardware_security_module_key_rotation_policy_resource_test.go

+}
+resource "azurerm_key_vault_certificate" "cert" {


Suggested change

}

resource "azurerm_key_vault_certificate" "cert" {

}

resource "azurerm_key_vault_certificate" "cert" {

wuxu92 · 2024-09-19T02:46:40Z

Test passed:

--- PASS: TestAccMHSMKeyRotationPolicy_all (2591.03s)
PASS
ok      github.com/hashicorp/terraform-provider-azurerm/internal/services/managedhsm 2591.069s

katbyte

Thanks @wuxu92 - LGTM 🛋️

website/docs/r/key_vault_managed_hardware_security_module_key_rotation_policy.html.markdown

…rotation_policy.html.markdown

github-actions · 2024-10-20T02:17:31Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

wuxu92 added 3 commits September 6, 2024 17:13

add mhsm key rotation resource

fcfc7be

only support rotate in mhsm key

a60b6a3

update rotation test and markdown document

bfa9f56

github-actions bot added documentation service/storage service/managed-hsm size/XL waiting-response labels Sep 6, 2024

doc format

69a0953

github-actions bot removed the waiting-response label Sep 6, 2024

wuxu92 marked this pull request as draft September 9, 2024 01:50

wuxu92 added 2 commits September 9, 2024 10:10

update test name

b10e444

fix rotate after create should be more than 28d

99f2ba0

wuxu92 marked this pull request as ready for review September 9, 2024 04:32

katbyte requested changes Sep 13, 2024

View reviewed changes

github-actions bot added the waiting-response label Sep 13, 2024

jackofallops requested changes Sep 13, 2024

View reviewed changes

update document for fields of rotation

e21d57e

github-actions bot added waiting-response and removed waiting-response labels Sep 13, 2024

fix typo

0a6b786

github-actions bot added waiting-response and removed waiting-response labels Sep 13, 2024

jackofallops requested changes Sep 16, 2024

View reviewed changes

fix typo

10c107a

github-actions bot removed the waiting-response label Sep 16, 2024

wuxu92 added 2 commits September 18, 2024 08:26

remove version id attribute

bd5698f

fix generated document

634bdda

katbyte approved these changes Sep 19, 2024

View reviewed changes

website/docs/r/key_vault_managed_hardware_security_module_key_rotation_policy.html.markdown Outdated Show resolved Hide resolved

website/docs/r/key_vault_managed_hardware_security_module_key_rotation_policy.html.markdown Outdated Show resolved Hide resolved

katbyte added 2 commits September 18, 2024 20:16

Update website/docs/r/key_vault_managed_hardware_security_module_key_…

ad939d6

…rotation_policy.html.markdown

Update website/docs/r/key_vault_managed_hardware_security_module_key_…

4917e68

…rotation_policy.html.markdown

katbyte merged commit 2fc6631 into hashicorp:main Sep 19, 2024
32 checks passed

github-actions bot added this to the v4.3.0 milestone Sep 19, 2024

katbyte added a commit that referenced this pull request Sep 19, 2024

Update CHANGELOG.md #27306

94d98b6

wuxu92 deleted the mhsm/key-rotate branch September 19, 2024 03:57

github-actions bot locked as resolved and limited conversation to collaborators Oct 20, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New resource: `azurerm_key_vault_managed_hardware_security_module_key_rotation_policy` #27306

New resource: `azurerm_key_vault_managed_hardware_security_module_key_rotation_policy` #27306

wuxu92 commented Sep 6, 2024 •

edited

Loading

katbyte Sep 13, 2024

katbyte Sep 13, 2024

wuxu92 Sep 14, 2024

katbyte Sep 13, 2024

wuxu92 Sep 14, 2024

katbyte Sep 13, 2024

wuxu92 Sep 14, 2024

katbyte Sep 13, 2024

wuxu92 Sep 14, 2024

jackofallops left a comment

jackofallops Sep 13, 2024

jackofallops Sep 13, 2024

wuxu92 Sep 13, 2024

jackofallops left a comment

jackofallops Sep 16, 2024

wuxu92 Sep 18, 2024

jackofallops Sep 16, 2024

wuxu92 Sep 18, 2024

jackofallops Sep 16, 2024

wuxu92 Sep 18, 2024

jackofallops Sep 16, 2024

jackofallops Sep 16, 2024

jackofallops Sep 16, 2024

wuxu92 commented Sep 19, 2024 •

edited

Loading

katbyte left a comment

github-actions bot commented Oct 20, 2024


		The following arguments are supported:

		* `expire_after` - (Required) Specify the expiration time of the key.

	* `expire_after` - (Required) Specify the expiration time of the key.
	* `expire_after_date` - (Required) Specify the expiration time of the key.

	* `expire_after` - (Required) Specify the expiration time of the key.
	* `expire_after_duration` - (Required) Specify the expiration time of the key.

		_, err = client.GetKey(ctx, keyID.BaseUri(), keyID.KeyName, "")
		if err != nil {

	expiryTime = utils.String(policy.ExipreAfter)
	expiryTime = pointer.To(policy.ExipreAfter)

	data := acceptance.BuildTestData(t, "azurerm_key_vault_managed_hardware_security_module_key", "test")
	data := acceptance.BuildTestData(t, "azurerm_key_vault_managed_hardware_security_module_key_rotation_policy", "test")

	// settign a blank policy to delete the existing policy
	// setting a blank policy to delete the existing policy

	ExipreAfter string `tfschema:"expire_after"`
	ExpireAfter string `tfschema:"expire_after"`

		}
		resource "azurerm_key_vault_managed_hardware_security_module" "test" {

New resource: azurerm_key_vault_managed_hardware_security_module_key_rotation_policy #27306

New resource: azurerm_key_vault_managed_hardware_security_module_key_rotation_policy #27306

Conversation

wuxu92 commented Sep 6, 2024 • edited Loading

Community Note

Description

PR Checklist

Changes to existing Resource / Data Source

Testing

Change Log

Related Issue(s)

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jackofallops left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jackofallops left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wuxu92 commented Sep 19, 2024 • edited Loading

katbyte left a comment

Choose a reason for hiding this comment

github-actions bot commented Oct 20, 2024

New resource: `azurerm_key_vault_managed_hardware_security_module_key_rotation_policy` #27306

New resource: `azurerm_key_vault_managed_hardware_security_module_key_rotation_policy` #27306

wuxu92 commented Sep 6, 2024 •

edited

Loading

wuxu92 commented Sep 19, 2024 •

edited

Loading