Support for system assigned identity for dead-lettering in Event Grid Subscription

[piotrgwiazda]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Support for system assigned identity for dead-lettering in Event Grid Subscription

New or Affected Resource(s)

• azurerm_eventgrid_event_subscription

Potential Terraform Configuration

resource "azurerm_eventgrid_event_subscription" "sample_topic_subscription" {
  name  = "example"
  scope = azurerm_eventgrid_domain_topic.sample.id

  # ...removed...

  storage_blob_dead_letter_destination {
    storage_account_id = azurerm_storage_account.example.id
    storage_blob_container_name = azurerm_storage_container.example.name

    # A new flag needed here, example:
    use_system_assigned_identity = true
  }
  
}

References

• #0000

[jrauschenbusch]

@piotrgwiazda I've started with an implementation for it. But as there could be more dead letter destinations within the future, i decided to hoist the identity configuration:

resource "azurerm_eventgrid_event_subscription" "example" {
  
  name  = "example"
  scope = azurerm_eventgrid_domain_topic.example.id

  # ...removed...

  # Seems to be linked to the Managed Identity of the Event source.
  # Portal check boy only available for endpoint types "Storage Queue", "Event Hubs", "Service Bus Queue", "Service Bus Topic".
  # Portal check box only enabled if Event source is configured with a managed identity (e.g. Domain/Topic)
  delivery_identity {
     # Allowed value is currently only "SystemAssigned".  "UserAssigned" will maybe possible in the future.
     type = "SystemAssigned" 
  }

  # Must only be set when "storage_blob_dead_letter_destination" is configured.
  dead_letter_identity {
     # Allowed value is currently only "SystemAssigned".  "UserAssigned" will maybe possible in the future.
     type = "SystemAssigned" 
  }
  
}

As you can see i'll also include support for delivery identity.

[tohov]

Any estimated schedule for this feature?

[jrauschenbusch]

Hi @tohov . As you can see, the PR was opened last year. It's up to the Terraform AzureRM provider team to review it. Unfortunately it seems, that one can actively ask for a review, but nothing happens.

I'll update the PR to fix the conflicts and try to trigger them a second time.

[tohov]

Hi! I'm quite new to GitHub issues so not aware of all the standard procedures. Thanks for understanding. And also thank you for trying to get this one resolved.

I noticed that running the tf config that does not have the identity declared will of course remove the selection of using the system assigned identity made by hand to the resource. So if the resource is deployed by tf you cannot use resource identity unless you taint the resource or do some other temporary hacks to not touch the resource while still adding/running other configs.

[ghost]

This has been released in version 2.55.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.55.0"
}
# ... other configuration ...

[github-actions]

This functionality has been released in v2.76.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.