Keyvault storage permissions

azurerm/data_source_key_vault.go

@@ -87,6 +87,13 @@ func dataSourceArmKeyVault() *schema.Resource {
 								Type: schema.TypeString,
 							},
 						},
+						"storage_permissions": {
+							Type:     schema.TypeList,
+							Computed: true,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
 					},
 				},
 			},

azurerm/helpers/azure/key_vault_access_policy.go

@@ -87,6 +87,33 @@ func SchemaKeyVaultSecretPermissions() *schema.Schema {
 	}
 }
 
+func SchemaKeyVaultStoragePermissions() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		Elem: &schema.Schema{
+			Type: schema.TypeString,
+			ValidateFunc: validation.StringInSlice([]string{
+				string(keyvault.StoragePermissionsBackup),
+				string(keyvault.StoragePermissionsDelete),
+				string(keyvault.StoragePermissionsDeletesas),
+				string(keyvault.StoragePermissionsGet),
+				string(keyvault.StoragePermissionsGetsas),
+				string(keyvault.StoragePermissionsList),
+				string(keyvault.StoragePermissionsListsas),
+				string(keyvault.StoragePermissionsPurge),
+				string(keyvault.StoragePermissionsRecover),
+				string(keyvault.StoragePermissionsRegeneratekey),
+				string(keyvault.StoragePermissionsRestore),
+				string(keyvault.StoragePermissionsSet),
+				string(keyvault.StoragePermissionsSetsas),
+				string(keyvault.StoragePermissionsUpdate),
+			}, true),
+			DiffSuppressFunc: suppress.CaseDifference,
+		},
+	}
+}
+
 func ExpandKeyVaultAccessPolicies(input []interface{}) (*[]keyvault.AccessPolicyEntry, error) {
 	output := make([]keyvault.AccessPolicyEntry, 0)
 
@@ -96,12 +123,14 @@ func ExpandKeyVaultAccessPolicies(input []interface{}) (*[]keyvault.AccessPolicy
 		certificatePermissionsRaw := policyRaw["certificate_permissions"].([]interface{})
 		keyPermissionsRaw := policyRaw["key_permissions"].([]interface{})
 		secretPermissionsRaw := policyRaw["secret_permissions"].([]interface{})
+		storagePermissionsRaw := policyRaw["storage_permissions"].([]interface{})
 
 		policy := keyvault.AccessPolicyEntry{
 			Permissions: &keyvault.Permissions{
 				Certificates: ExpandCertificatePermissions(certificatePermissionsRaw),
 				Keys:         ExpandKeyPermissions(keyPermissionsRaw),
 				Secrets:      ExpandSecretPermissions(secretPermissionsRaw),
+				Storage:      ExpandStoragePermissions(storagePermissionsRaw),
 			},
 		}
 
@@ -152,6 +181,9 @@ func FlattenKeyVaultAccessPolicies(policies *[]keyvault.AccessPolicyEntry) []map
 
 			secrets := FlattenSecretPermissions(permissions.Secrets)
 			policyRaw["secret_permissions"] = secrets
+
+			storage := FlattenStoragePermissions(permissions.Storage)
+			policyRaw["storage_permissions"] = storage
 		}
 
 		result = append(result, policyRaw)
@@ -224,3 +256,25 @@ func FlattenSecretPermissions(input *[]keyvault.SecretPermissions) []interface{}
 
 	return output
 }
+
+func ExpandStoragePermissions(input []interface{}) *[]keyvault.StoragePermissions {
+	output := make([]keyvault.StoragePermissions, 0)
+
+	for _, permission := range input {
+		output = append(output, keyvault.StoragePermissions(permission.(string)))
+	}
+
+	return &output
+}
+
+func FlattenStoragePermissions(input *[]keyvault.StoragePermissions) []interface{} {
+	output := make([]interface{}, 0)
+
+	if input != nil {
+		for _, storagePermission := range *input {
+			output = append(output, string(storagePermission))
+		}
+	}
+
+	return output
+}

azurerm/resource_arm_key_vault.go

@@ -105,6 +105,7 @@ func resourceArmKeyVault() *schema.Resource {
 						"certificate_permissions": azure.SchemaKeyVaultCertificatePermissions(),
 						"key_permissions":         azure.SchemaKeyVaultKeyPermissions(),
 						"secret_permissions":      azure.SchemaKeyVaultSecretPermissions(),
+						"storage_permissions":     azure.SchemaKeyVaultStoragePermissions(),
 					},
 				},
 			},

azurerm/resource_arm_key_vault_certificate_test.go

@@ -390,6 +390,10 @@ resource "azurerm_key_vault" "test" {
     secret_permissions = [
       "set",
     ]
+
+    storage_permissions = [
+      "set",
+    ]
   }
 }
 
@@ -458,6 +462,10 @@ resource "azurerm_key_vault" "test" {
     secret_permissions = [
       "set",
     ]
+
+    storage_permissions = [
+      "set",
+    ]
   }
 }
 
@@ -560,6 +568,10 @@ resource "azurerm_key_vault" "test" {
     secret_permissions = [
       "set",
     ]
+
+    storage_permissions = [
+      "set",
+    ]
   }
 }
 
@@ -648,6 +660,10 @@ resource "azurerm_key_vault" "test" {
     secret_permissions = [
       "set",
     ]
+
+    storage_permissions = [
+      "set",
+    ]
   }
 }
 
@@ -835,6 +851,10 @@ resource "azurerm_key_vault" "test" {
     secret_permissions = [
       "set",
     ]
+
+    storage_permissions = [
+      "set",
+    ]
   }
 }
 

azurerm/resource_arm_key_vault_migration.go

@@ -141,6 +141,35 @@ func migrateAzureRMKeyVaultStateV0toV1AccessPolicies(is *terraform.InstanceState
 			}
 		}
 
+		if v, ok := policy["storage_permissions"]; ok {
+			inputStoragePermissions := v.([]interface{})
+			outputStoragePermissions := make([]string, 0)
+			for _, p := range inputStoragePermissions {
+				permission := p.(string)
+				if strings.ToLower(permission) == "all" {
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsBackup))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsDelete))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsDeletesas))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsGet))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsGetsas))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsList))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsListsas))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsPurge))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsRecover))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsRegeneratekey))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsRestore))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsSet))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsSetsas))
+					outputStoragePermissions = append(outputStoragePermissions, string(keyvault.StoragePermissionsUpdate))
+					break
+				}
+			}
+
+			if len(outputStoragePermissions) > 0 {
+				policy["storage_permissions"] = outputStoragePermissions
+			}
+		}
+
 		outputAccessPolicies = append(outputAccessPolicies, policy)
 	}