Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow allow_blob_public_access and min_tls_version on azurerm_storage_account in USGovernmentCloud #9540

Merged
merged 2 commits into from
Dec 9, 2020
Merged

Allow allow_blob_public_access and min_tls_version on azurerm_storage_account in USGovernmentCloud #9540

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0774e82
#9540
ruandersMSFT Dec 7, 2020
63dc644
#9540
ruandersMSFT Dec 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions azurerm/internal/services/storage/resource_arm_storage_account.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -665,11 +665,13 @@ func resourceArmStorageAccountCreate(d *schema.ResourceData, meta interface{}) e
},
}

// For all Clouds except Public, don't specify "allow_blob_public_access" and "min_tls_version" in request body.
// For all Clouds except Public and USGovernmentCloud, don't specify "allow_blob_public_access" and "min_tls_version" in request body.
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/7812
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/8083
if envName != autorestAzure.PublicCloud.Name {
if allowBlobPublicAccess || minimumTLSVersion != string(storage.TLS10) {
// USGovernmentCloud allow_blob_public_access and min_tls_version allowed as of issue 9128
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/9128
if envName != autorestAzure.PublicCloud.Name && envName != autorestAzure.USGovernmentCloud.Name {
if allowBlobPublicAccess && minimumTLSVersion != string(storage.TLS10) {
return fmt.Errorf(`"allow_blob_public_access" and "min_tls_version" are not supported for a Storage Account located in %q`, envName)
}
} else {
Expand Down Expand Up @@ -919,9 +921,11 @@ func resourceArmStorageAccountUpdate(d *schema.ResourceData, meta interface{}) e
if d.HasChange("min_tls_version") {
minimumTLSVersion := d.Get("min_tls_version").(string)

// For all Clouds except Public, don't specify "min_tls_version" in request body.
// For all Clouds except Public and USGovernmentCloud, don't specify "min_tls_version" in request body.
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/8083
if envName != autorestAzure.PublicCloud.Name {
// USGovernmentCloud "min_tls_version" allowed as of issue 9128
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/9128
if envName != autorestAzure.PublicCloud.Name && envName != autorestAzure.USGovernmentCloud.Name {
if minimumTLSVersion != string(storage.TLS10) {
return fmt.Errorf(`"min_tls_version" is not supported for a Storage Account located in %q`, envName)
}
Expand All @@ -941,9 +945,11 @@ func resourceArmStorageAccountUpdate(d *schema.ResourceData, meta interface{}) e
if d.HasChange("allow_blob_public_access") {
allowBlobPublicAccess := d.Get("allow_blob_public_access").(bool)

// For all Clouds except Public, don't specify "allow_blob_public_access" in request body.
// For all Clouds except Public and USGovernmentCloud, don't specify "allow_blob_public_access" in request body.
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/7812
if envName != autorestAzure.PublicCloud.Name {
// USGovernmentCloud "allow_blob_public_access" allowed as of issue 9128
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/9128
if envName != autorestAzure.PublicCloud.Name && envName != autorestAzure.USGovernmentCloud.Name {
if allowBlobPublicAccess {
return fmt.Errorf(`"allow_blob_public_access" is not supported for a Storage Account located in %q`, envName)
}
Expand Down Expand Up @@ -1131,10 +1137,13 @@ func resourceArmStorageAccountRead(d *schema.ResourceData, meta interface{}) err
d.Set("enable_https_traffic_only", props.EnableHTTPSTrafficOnly)
d.Set("is_hns_enabled", props.IsHnsEnabled)
d.Set("allow_blob_public_access", props.AllowBlobPublicAccess)
// For all Clouds except Public, "min_tls_version" is not returned from Azure so always persist the default values for "min_tls_version".
// For all Clouds except Public and USGovernmentCloud, "min_tls_version" is not returned from Azure so always persist the default values for "min_tls_version".
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/7812
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/8083
if meta.(*clients.Client).Account.Environment.Name != autorestAzure.PublicCloud.Name {
// USGovernmentCloud "min_tls_version" allowed as of issue 9128
// https://github.com/terraform-providers/terraform-provider-azurerm/issues/9128
envName := meta.(*clients.Client).Account.Environment.Name
if envName != autorestAzure.PublicCloud.Name && envName != autorestAzure.USGovernmentCloud.Name {
d.Set("min_tls_version", string(storage.TLS10))
} else {
// For storage account created using old API, the response of GET call will not return "min_tls_version", either.
Expand Down
4 changes: 2 additions & 2 deletions website/docs/r/storage_account.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,11 +99,11 @@ The following arguments are supported:

* `min_tls_version` - (Optional) The minimum supported TLS version for the storage account. Possible values are `TLS1_0`, `TLS1_1`, and `TLS1_2`. Defaults to `TLS1_0` for new storage accounts.

-> **NOTE:** At this time `min_tls_version` is only supported in the Public Cloud.
-> **NOTE:** At this time `min_tls_version` is only supported in the Public Cloud and US Government Cloud.

* `allow_blob_public_access` - Allow or disallow public access to all blobs or containers in the storage account. Defaults to `false`.

-> **NOTE:** At this time `allow_blob_public_access` is only supported in the Public Cloud.
-> **NOTE:** At this time `allow_blob_public_access` is only supported in the Public Cloud and US Government Cloud.

* `is_hns_enabled` - (Optional) Is Hierarchical Namespace enabled? This can be used with Azure Data Lake Storage Gen 2 ([see here for more information](https://docs.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-quickstart-create-account/)). Changing this forces a new resource to be created.

Expand Down