add resource "azurerm_data_protection_backup_instance_blob_storage"

[ms-henglu]

The added tests are

=== RUN   TestAccDataProtectionBackupInstanceBlobStorage_basic
=== PAUSE TestAccDataProtectionBackupInstanceBlobStorage_basic
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_basic
--- PASS: TestAccDataProtectionBackupInstanceBlobStorage_basic (366.06s)
=== RUN   TestAccDataProtectionBackupInstanceBlobStorage_requiresImport
=== PAUSE TestAccDataProtectionBackupInstanceBlobStorage_requiresImport
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_requiresImport
--- PASS: TestAccDataProtectionBackupInstanceBlobStorage_requiresImport (318.62s)
=== RUN   TestAccDataProtectionBackupInstanceBlobStorage_complete
=== PAUSE TestAccDataProtectionBackupInstanceBlobStorage_complete
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_complete
--- PASS: TestAccDataProtectionBackupInstanceBlobStorage_complete (426.61s)
=== RUN   TestAccDataProtectionBackupInstanceBlobStorage_update
=== PAUSE TestAccDataProtectionBackupInstanceBlobStorage_update
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_update
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_update
--- PASS: TestAccDataProtectionBackupInstanceBlobStorage_update (280.66s)

[katbyte]

Thanks @ms-henglu - looks good but we have some tests failing:

------- Stdout: -------
=== RUN   TestAccDataProtectionBackupInstanceBlobStorage_basic
=== PAUSE TestAccDataProtectionBackupInstanceBlobStorage_basic
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_basic
    testing_new.go:70: Error running post-test destroy, there may be dangling resources: exit status 1
        
        Error: authorization.RoleAssignmentsClient#Delete: Failure responding to request: StatusCode=409 -- Original Error: autorest/azure: Service returned an error. Status=409 Code="ScopeLocked" Message="The scope '/subscriptions/*******/resourceGroups/acctest-dataprotection-210729063221901155/providers/Microsoft.Storage/storageAccounts/acctestsa21072955/providers/Microsoft.Authorization/roleAssignments/9270a77d-c21e-cc6f-65a9-90ae67476f4f' cannot perform delete operation because following scope(s) are locked: '/subscriptions/*******/resourcegroups/acctest-dataprotection-210729063221901155/providers/Microsoft.Storage/storageAccounts/acctestsa21072955'. Please remove the lock and try again."
        
--- FAIL: TestAccDataProtectionBackupInstanceBlobStorage_basic (236.38s)
FAIL

[katbyte]

tests are still failing:

------- Stdout: -------
=== RUN   TestAccDataProtectionBackupInstanceBlobStorage_basic
=== PAUSE TestAccDataProtectionBackupInstanceBlobStorage_basic
=== CONT  TestAccDataProtectionBackupInstanceBlobStorage_basic
    testing_new.go:70: Error running post-test destroy, there may be dangling resources: exit status 1
        
        Error: authorization.RoleAssignmentsClient#Delete: Failure responding to request: StatusCode=409 -- Original Error: autorest/azure: Service returned an error. Status=409 Code="ScopeLocked" Message="The scope '/subscriptions/*******/resourceGroups/acctest-dataprotection-210817021616868403/providers/Microsoft.Storage/storageAccounts/acctestsa21081703/providers/Microsoft.Authorization/roleAssignments/03ab8de1-b4fe-108f-3987-505be9ffdd06' cannot perform delete operation because following scope(s) are locked: '/subscriptions/*******/resourcegroups/acctest-dataprotection-210817021616868403/providers/Microsoft.Storage/storageAccounts/acctestsa21081703'. Please remove the lock and try again."
        
--- FAIL: TestAccDataProtectionBackupInstanceBlobStorage_basic (213.92s)
FAIL

[ms-henglu]

I think the cause is

resource "azurerm_role_assignment" "test" {
  scope                = azurerm_storage_account.test.id
  role_definition_name = "Storage Account Backup Contributor Role"
  principal_id         = azurerm_data_protection_backup_vault.test.identity[0].principal_id
}

But this role is required to provision backup instance for blob storage, otherwise it will fail.

Hi @katbyte , is it possible to remove the lock on storage account?

following scope(s) are locked: '/subscriptions/*******/resourcegroups/acctest-dataprotection-210817021616868403/providers/Microsoft.Storage/storageAccounts/acctestsa21081703'

[owenfarrell]

I didn't realize this PR was open when I opened #13071.

One key element that is different is in the implementation of the acceptance tests. And it relates to the race condition captured in this thread.

Since Azure backup creates a DoNotDelete lock on the storage account, the azurerm_data_protection_backup_instance_blob_storage resource must be destoryed before the role assignment is destroyed.

To account for this, I intentionally added a depends_on reference in the acceptance test (and the example documentation) to ensure the sequence of create/destroy operations is correct.

The rest of our implementation got to almost the exact same place with only some minor differences (i.e., my acceptance tests use indexed verbs, my error messages use the String() function from the generated struct for backup instance IDs).

Hopefully that sheds some light on why you're seeing different results. Race conditions - yay!

[ms-henglu]

@owenfarrell , Hi!

Thank you so much for the help!! It did fix the tests.

[ms-henglu]

@katbyte , Hi, I've fixed the tests, please take another look, thanks!

[owenfarrell]

@ms-henglu Glad I could help!

On a related note, I think the trend of this provider is to use indexed verbs in the acceptance test format strings to avoid unnecessary repetition in the parameters (i.e., multiple RandomInt parameters) and minimize the impact of future changes (e.g., adding a new parameter that isn't last).

The other emerging trend is to use the String() function to generate error messages in a more consistent and simple way - you won't need as many parameters, or even as much text.

I can't take credit for the above guidance. I'm just relaying feedback that I previously received and have incorporated in to other changes. And I totally understand how you got to where you did - I used the PostgreSQL backup instance as a starting point, too.

[ms-henglu]

@katbyte , could you please take another look? All tests passed.

[katbyte]

Thanks @ms-henglu - LGTM 🌿

[github-actions]

This functionality has been released in v2.76.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.