Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_key_vault_key - allow rotation_policy to be removed #21935

Merged
merged 4 commits into from
Jun 8, 2023
Merged

azurerm_key_vault_key - allow rotation_policy to be removed #21935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
48b1bd4
allow rotation_policy to be removed
catriona-m May 25, 2023
31c3831
cast rotation_policy before passing to expand
catriona-m Jun 1, 2023
de543df
set autoRotation fields
catriona-m Jun 2, 2023
74375e3
add rotation policy removal test
jackofallops Jun 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 20 additions & 19 deletions internal/services/keyvault/key_vault_key_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (

"github.com/Azure/go-autorest/autorest"
"github.com/Azure/go-autorest/autorest/date"
"github.com/hashicorp/go-azure-helpers/lang/pointer"
"github.com/hashicorp/go-azure-helpers/lang/response"
"github.com/hashicorp/go-azure-helpers/resourcemanager/commonids"
"github.com/hashicorp/go-azure-helpers/resourcemanager/commonschema"
Expand Down Expand Up @@ -140,7 +141,6 @@ func resourceKeyVaultKey() *pluginsdk.Resource {
"rotation_policy": {
Type: pluginsdk.TypeList,
Optional: true,
Computed: true,
MaxItems: 1,
Elem: &pluginsdk.Resource{
Schema: map[string]*pluginsdk.Schema{
Expand Down Expand Up @@ -355,7 +355,7 @@ func resourceKeyVaultKeyCreate(d *pluginsdk.ResourceData, meta interface{}) erro
}

if v, ok := d.GetOk("rotation_policy"); ok {
if respPolicy, err := client.UpdateKeyRotationPolicy(ctx, *keyVaultBaseUri, name, expandKeyVaultKeyRotationPolicy(v)); err != nil {
if respPolicy, err := client.UpdateKeyRotationPolicy(ctx, *keyVaultBaseUri, name, expandKeyVaultKeyRotationPolicy(v.([]interface{}))); err != nil {
if utils.ResponseWasForbidden(respPolicy.Response) {
return fmt.Errorf("current client lacks permissions to create Key Rotation Policy for Key %q (%q, Vault url: %q), please update this as described here: %s : %v", name, *keyVaultId, *keyVaultBaseUri, "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#example-usage", err)
}
Expand Down Expand Up @@ -436,12 +436,12 @@ func resourceKeyVaultKeyUpdate(d *pluginsdk.ResourceData, meta interface{}) erro
return err
}

if v, ok := d.GetOk("rotation_policy"); ok {
if respPolicy, err := client.UpdateKeyRotationPolicy(ctx, id.KeyVaultBaseUrl, id.Name, expandKeyVaultKeyRotationPolicy(v)); err != nil {
if d.HasChange("rotation_policy"); ok {
if respPolicy, err := client.UpdateKeyRotationPolicy(ctx, id.KeyVaultBaseUrl, id.Name, expandKeyVaultKeyRotationPolicy(d.Get("rotation_policy").([]interface{}))); err != nil {
if utils.ResponseWasForbidden(respPolicy.Response) {
return fmt.Errorf("current client lacks permissions to update Key Rotation Policy for Key %q (%q, Vault url: %q), please update this as described here: %s : %v", id.Name, *keyVaultId, id.KeyVaultBaseUrl, "https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_key#example-usage", err)
}
return fmt.Errorf("Creating Key Rotation Policy: %+v", err)
return fmt.Errorf("creating Key Rotation Policy: %+v", err)
}
}

Expand Down Expand Up @@ -697,9 +697,12 @@ func expandKeyVaultKeyOptions(d *pluginsdk.ResourceData) *[]keyvault.JSONWebKeyO
return &results
}

func expandKeyVaultKeyRotationPolicy(v interface{}) keyvault.KeyRotationPolicy {
policies := v.([]interface{})
policy := policies[0].(map[string]interface{})
func expandKeyVaultKeyRotationPolicy(v []interface{}) keyvault.KeyRotationPolicy {
if len(v) == 0 {
return keyvault.KeyRotationPolicy{LifetimeActions: &[]keyvault.LifetimeActions{}}
}

policy := v[0].(map[string]interface{})

var expiryTime *string = nil // needs to be set to nil if not set
if rawExpiryTime := policy["expire_after"]; rawExpiryTime != nil && rawExpiryTime.(string) != "" {
Expand Down Expand Up @@ -775,26 +778,24 @@ func flattenKeyVaultKeyRotationPolicy(input keyvault.KeyRotationPolicy) []interf
trigger := ltAction.Trigger

if action != nil && trigger != nil && action.Type != "" && strings.EqualFold(string(action.Type), string(keyvault.KeyRotationPolicyActionNotify)) && trigger.TimeBeforeExpiry != nil && *trigger.TimeBeforeExpiry != "" {
policy["notify_before_expiry"] = *trigger.TimeBeforeExpiry
// Somehow a default is set after creation for notify_before_expiry
// Submitting this set value in the next run will not work though..
if policy["expire_after"] != nil {
policy["notify_before_expiry"] = *trigger.TimeBeforeExpiry
}
}

if action != nil && trigger != nil && action.Type != "" && strings.EqualFold(string(action.Type), string(keyvault.KeyRotationPolicyActionRotate)) {
autoRotation := make(map[string]interface{}, 0)
if timeAfterCreate := trigger.TimeAfterCreate; timeAfterCreate != nil {
autoRotation["time_after_creation"] = *timeAfterCreate
}
if timeBeforeExpiry := trigger.TimeBeforeExpiry; timeBeforeExpiry != nil {
autoRotation["time_before_expiry"] = *timeBeforeExpiry
}
autoRotation["time_after_creation"] = pointer.From(trigger.TimeAfterCreate)
autoRotation["time_before_expiry"] = pointer.From(trigger.TimeBeforeExpiry)
policy["automatic"] = []map[string]interface{}{autoRotation}
}
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the policy block is being set into the state then all fields need to be set all of the time, fwiw

}

// Somehow a default is set after creation for notify_before_expiry
// Submitting this set value in the next run will not work though..
if policy["expire_after"] == nil {
policy["notify_before_expiry"] = nil
if len(policy) == 0 {
return []interface{}{}
}

return []interface{}{policy}
Expand Down
29 changes: 29 additions & 0 deletions internal/services/keyvault/key_vault_key_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,6 +315,35 @@ func TestAccKeyVaultKey_RotationPolicyWithOnlyAutoRotation(t *testing.T) {
})
}

func TestAccKeyVaultKey_RemoveRotationPolicy(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_key_vault_key", "test")
r := KeyVaultKeyResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
{
Config: r.basicEC(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("key_size", "key_vault_id"),
{
Config: r.rotationPolicyWithOnlyAutoRotation(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("key_size", "key_vault_id"),
{
Config: r.basicEC(data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("key_size", "key_vault_id"),
})
}

func TestAccKeyVaultKey_RotationPolicyUpdate(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_key_vault_key", "test")
r := KeyVaultKeyResource{}
Expand Down