Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_synapse_workspace - support for the customer_managed_key_versionless_id property #11328

Merged
merged 5 commits into from
Apr 27, 2021
Merged

azurerm_synapse_workspace - support for the customer_managed_key_versionless_id property #11328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fd3779b
adding cmk to synapse
allantargino Apr 14, 2021
f386a6b
removing deprecated functionality
allantargino Apr 14, 2021
71c855a
Merge branch 'master' into synapse-double-encryption
allantargino Apr 22, 2021
092b03c
renaming to customer_managed_key_versionless_id
allantargino Apr 22, 2021
f37ed5e
adding purge_soft_delete_on_destroy again
allantargino Apr 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 37 additions & 10 deletions azurerm/internal/services/synapse/synapse_workspace_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import (
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/tf"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/location"
keyVaultValidate "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/keyvault/validate"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/synapse/parse"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/synapse/validate"
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/tags"
Expand Down Expand Up @@ -228,6 +229,12 @@ func resourceSynapseWorkspace() *schema.Resource {
Optional: true,
},

"customer_managed_key_versionless_id": {
Type: schema.TypeString,
Optional: true,
ValidateFunc: keyVaultValidate.VersionlessNestedItemId,
},

"tags": tags.Schema(),
},
}
Expand Down Expand Up @@ -267,6 +274,7 @@ func resourceSynapseWorkspaceCreate(d *schema.ResourceData, meta interface{}) er
SQLAdministratorLoginPassword: utils.String(d.Get("sql_administrator_login_password").(string)),
ManagedResourceGroupName: utils.String(d.Get("managed_resource_group_name").(string)),
WorkspaceRepositoryConfiguration: expandWorkspaceRepositoryConfiguration(d),
Encryption: expandEncryptionDetails(d),
},
Identity: &synapse.ManagedIdentity{
Type: synapse.ResourceIdentityTypeSystemAssigned,
Expand Down Expand Up @@ -300,16 +308,10 @@ func resourceSynapseWorkspaceCreate(d *schema.ResourceData, meta interface{}) er
return fmt.Errorf("Granting workspace identity control for SQL pool: %+v", err)
}

resp, err := client.Get(ctx, resourceGroup, name)
if err != nil {
return fmt.Errorf("retrieving Synapse Workspace %q (Resource Group %q): %+v", name, resourceGroup, err)
}

if resp.ID == nil || *resp.ID == "" {
return fmt.Errorf("empty or nil ID returned for Synapse Workspace %q (Resource Group %q) ID", name, resourceGroup)
}
subscriptionId := meta.(*clients.Client).Account.SubscriptionId
id := parse.NewWorkspaceID(subscriptionId, resourceGroup, name)
d.SetId(id.ID())

d.SetId(*resp.ID)
return resourceSynapseWorkspaceRead(d, meta)
}

Expand Down Expand Up @@ -363,6 +365,7 @@ func resourceSynapseWorkspaceRead(d *schema.ResourceData, meta interface{}) erro
d.Set("sql_administrator_login", props.SQLAdministratorLogin)
d.Set("managed_resource_group_name", props.ManagedResourceGroupName)
d.Set("connectivity_endpoints", utils.FlattenMapStringPtrString(props.ConnectivityEndpoints))
d.Set("customer_managed_key_versionless_id", flattenEncryptionDetails(props.Encryption))

repoType, repo := flattenWorkspaceRepositoryConfiguration(props.WorkspaceRepositoryConfiguration)
if repoType == workspaceVSTSConfiguration {
Expand Down Expand Up @@ -397,12 +400,13 @@ func resourceSynapseWorkspaceUpdate(d *schema.ResourceData, meta interface{}) er
return err
}

if d.HasChanges("tags", "sql_administrator_login_password", "github_repo", "azure_devops_repo") {
if d.HasChanges("tags", "sql_administrator_login_password", "github_repo", "azure_devops_repo", "customer_managed_key_versionless_id") {
workspacePatchInfo := synapse.WorkspacePatchInfo{
Tags: tags.Expand(d.Get("tags").(map[string]interface{})),
WorkspacePatchProperties: &synapse.WorkspacePatchProperties{
SQLAdministratorLoginPassword: utils.String(d.Get("sql_administrator_login_password").(string)),
WorkspaceRepositoryConfiguration: expandWorkspaceRepositoryConfiguration(d),
Encryption: expandEncryptionDetails(d),
},
}

Expand Down Expand Up @@ -542,6 +546,20 @@ func expandIdentityControlSQLSettings(enabled bool) *synapse.ManagedIdentitySQLC
}
}

func expandEncryptionDetails(d *schema.ResourceData) *synapse.EncryptionDetails {
if key, ok := d.GetOk("customer_managed_key_versionless_id"); ok {
return &synapse.EncryptionDetails{
Cmk: &synapse.CustomerManagedKeyDetails{
Key: &synapse.WorkspaceKeyDetails{
Name: utils.String("cmk"),
KeyVaultURL: utils.String(key.(string)),
},
},
}
}
return nil
}

func flattenArmWorkspaceManagedIdentity(input *synapse.ManagedIdentity) []interface{} {
if input == nil {
return make([]interface{}, 0)
Expand Down Expand Up @@ -642,3 +660,12 @@ func flattenIdentityControlSQLSettings(settings synapse.ManagedIdentitySQLContro

return false
}

func flattenEncryptionDetails(encryption *synapse.EncryptionDetails) *string {
if cmk := encryption.Cmk; cmk != nil {
if key := cmk.Key; key != nil {
return key.KeyVaultURL
}
}
return nil
}
72 changes: 71 additions & 1 deletion azurerm/internal/services/synapse/synapse_workspace_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,22 @@ func TestAccSynapseWorkspace_github(t *testing.T) {
})
}

func TestAccSynapseWorkspace_customerManagedKey(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_synapse_workspace", "test")
r := SynapseWorkspaceResource{}

data.ResourceTest(t, r, []resource.TestStep{
{
Config: r.customerManagedKey(data),
Check: resource.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
check.That(data.ResourceName).Key("customer_managed_key_versionless_id").Exists(),
),
},
data.ImportStep("sql_administrator_login_password"),
})
}

func (r SynapseWorkspaceResource) Exists(ctx context.Context, client *clients.Client, state *terraform.InstanceState) (*bool, error) {
id, err := parse.WorkspaceID(state.ID)
if err != nil {
Expand Down Expand Up @@ -280,10 +296,64 @@ resource "azurerm_synapse_workspace" "test" {
`, template, data.RandomInteger)
}

func (r SynapseWorkspaceResource) customerManagedKey(data acceptance.TestData) string {
template := r.template(data)
return fmt.Sprintf(`
%s

data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "test" {
name = "acckv%d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
tenant_id = data.azurerm_client_config.current.tenant_id
sku_name = "standard"
purge_protection_enabled = true

access_policy {
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
key_permissions = [
"create",
"get",
"delete",
"purge"
]
}
}

resource "azurerm_key_vault_key" "test" {
name = "key"
key_vault_id = azurerm_key_vault.test.id
key_type = "RSA"
key_size = 2048
key_opts = [
"unwrapKey",
"wrapKey"
]
}

resource "azurerm_synapse_workspace" "test" {
name = "acctestsw%d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.test.id
sql_administrator_login = "sqladminuser"
sql_administrator_login_password = "H@Sh1CoR3!"
customer_managed_key_versionless_id = azurerm_key_vault_key.test.versionless_id
}
`, template, data.RandomInteger, data.RandomInteger)
}

func (r SynapseWorkspaceResource) template(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
features {
key_vault {
purge_soft_delete_on_destroy = false
}
Comment on lines +353 to +355
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason for disabling the purge_soft_delete_on_destroy feature?

Copy link
Contributor Author

@allantargino allantargino Apr 22, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added it because I keep receive the following error message:

The user, group or application 'appid=...;oid=...;iss=https://sts.windows.net/.../' does not have keys purge permission on key vault 'acckv210422144256592239;location=...'

Even though I set the permissions on the KV terraform code:

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id
    key_permissions = [
      "create",
      "get",
      "delete",
      "purge"
    ]
  }

}
}

resource "azurerm_resource_group" "test" {
Expand Down
2 changes: 2 additions & 0 deletions website/docs/r/synapse_workspace.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,8 @@ The following arguments are supported:

* `github_repo` - (Optional) A `github_repo` block as defined below.

* `customer_managed_key_versionless_id` - (Optional) The Azure Key Vault Key Versionless ID to be used as the Customer Managed Key (CMK) for double encryption (e.g. `https://example-keyvault.vault.azure.net/type/cmk/`).

* `tags` - (Optional) A mapping of tags which should be assigned to the Synapse Workspace.

---
Expand Down