azurerm_recovery_services_vault: Support for identity block

azurerm/internal/services/recoveryservices/resource_arm_recovery_services_vault.go

@@ -50,6 +50,33 @@ func resourceArmRecoveryServicesVault() *schema.Resource {
 
 			"resource_group_name": azure.SchemaResourceGroupName(),
 
+			"identity": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"type": {
+							Type:     schema.TypeString,
+							Required: true,
+							ValidateFunc: validation.StringInSlice([]string{
+								string(recoveryservices.SystemAssigned),
+							}, false),
+						},
+
+						"principal_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+
+						"tenant_id": {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+
 			"tags": tags.Schema(),
 
 			"sku": {
@@ -100,6 +127,7 @@ func resourceArmRecoveryServicesVaultCreateUpdate(d *schema.ResourceData, meta i
 	vault := recoveryservices.Vault{
 		Location: utils.String(location),
 		Tags:     tags.Expand(t),
+		Identity: expandValutIdentity(d.Get("identity").([]interface{})),
 		Sku: &recoveryservices.Sku{
 			Name: recoveryservices.SkuName(d.Get("sku").(string)),
 		},
@@ -208,6 +236,10 @@ func resourceArmRecoveryServicesVaultRead(d *schema.ResourceData, meta interface
 		d.Set("soft_delete_enabled", props.SoftDeleteFeatureState == backup.SoftDeleteFeatureStateEnabled)
 	}
 
+	if err := d.Set("identity", flattenVaultIdentity(resp.Identity)); err != nil {
+		return fmt.Errorf("Error setting `identity`: %+v", err)
+	}
+
 	return tags.FlattenAndSet(d, resp.Tags)
 }
 
@@ -235,3 +267,38 @@ func resourceArmRecoveryServicesVaultDelete(d *schema.ResourceData, meta interfa
 
 	return nil
 }
+
+func expandValutIdentity(input []interface{}) *recoveryservices.IdentityData {
+	if len(input) == 0 {
+		return nil
+	}
+
+	v := input[0].(map[string]interface{})
+	return &recoveryservices.IdentityData{
+		Type: recoveryservices.ResourceIdentityType(v["type"].(string)),
+	}
+}
+
+func flattenVaultIdentity(input *recoveryservices.IdentityData) []interface{} {
+	if input == nil {
+		return []interface{}{}
+	}
+
+	principalID := ""
+	if input.PrincipalID != nil {
+		principalID = *input.PrincipalID
+	}
+
+	tenantID := ""
+	if input.TenantID != nil {
+		tenantID = *input.TenantID
+	}
+
+	return []interface{}{
+		map[string]interface{}{
+			"type":         string(input.Type),
+			"principal_id": principalID,
+			"tenant_id":    tenantID,
+		},
+	}
+}

azurerm/internal/services/recoveryservices/tests/resource_arm_recovery_services_vault_test.go

@@ -106,6 +106,25 @@ func TestAccAzureRMRecoveryServicesVault_requiresImport(t *testing.T) {
 	})
 }
 
+func TestRecoveryServicesVault_basicWithIdentity(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_recovery_services_vault", "test")
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acceptance.PreCheck(t) },
+		Providers:    acceptance.SupportedProviders,
+		CheckDestroy: testCheckAzureRMRecoveryServicesVaultDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testRecoveryServicesVault_basicWithIdentity(data),
+				Check: resource.ComposeTestCheckFunc(
+					testCheckAzureRMRecoveryServicesVaultExists(data.ResourceName),
+				),
+			},
+			data.ImportStep(),
+		},
+	})
+}
+
 func testCheckAzureRMRecoveryServicesVaultDestroy(s *terraform.State) error {
 	client := acceptance.AzureProvider.Meta().(*clients.Client).RecoveryServices.VaultsClient
 	ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
@@ -185,6 +204,32 @@ resource "azurerm_recovery_services_vault" "test" {
 `, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
 }
 
+func testRecoveryServicesVault_basicWithIdentity(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-recovery-%d"
+  location = "%s"
+}
+
+resource "azurerm_recovery_services_vault" "test" {
+  name                = "acctest-Vault-%d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  sku                 = "Standard"
+
+  identity {
+    type = "SystemAssigned"
+  }
+
+  soft_delete_enabled = false
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
+}
+
 func testAccAzureRMRecoveryServicesVault_complete(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 provider "azurerm" {

website/docs/r/app_service_managed_certificate.html.markdown

@@ -112,4 +112,4 @@ App Service Managed Certificates can be imported using the `resource id`, e.g.
 
 ```shell
 terraform import azurerm_app_service_managed_certificate.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resGroup1/providers/Microsoft.Web/certificates/customhost.contoso.com
-```
+```

website/docs/r/recovery_services_vault.markdown

@@ -40,10 +40,20 @@ The following arguments are supported:
 
 * `tags` - (Optional) A mapping of tags to assign to the resource.
 
+* `identity` - (Optional) An `identity` block as defined below. 
+
 * `sku` - (Required) Sets the vault's SKU. Possible values include: `Standard`, `RS0`.
 
 * `soft_delete_enabled` - (Optional) Is soft delete enable for this Vault? Defaults to `true`.
 
+---
+
+An `identity` block supports the following:
+
+* `type` - (Required) The Type of Identity which should be used for this Recovery Services Vault. At this time the only possible value is `SystemAssigned`.
+
+---
+
 ## Attributes Reference
 
 The following attributes are exported: