azurerm_eventgrid_event_subscription/azurerm_eventgrid_system_topic_event_subscription - support delivery_identity & dead_letter_identity

internal/services/eventgrid/event_subscription.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/Azure/azure-sdk-for-go/services/preview/eventgrid/mgmt/2020-10-15-preview/eventgrid"
 	"github.com/Azure/go-autorest/autorest/date"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-provider-azurerm/helpers/azure"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/validation"
@@ -778,7 +779,26 @@ func eventSubscriptionSchemaLabels() *pluginsdk.Schema {
 	}
 }
 
-func expandEventGridExpirationTime(d *pluginsdk.ResourceData) (*date.Time, error) {
+func eventSubscriptionSchemaIdentity() *schema.Schema {
+	return &schema.Schema{
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
+		Elem: &schema.Resource{
+			Schema: map[string]*schema.Schema{
+				"type": {
+					Type:     schema.TypeString,
+					Required: true,
+					ValidateFunc: validation.StringInSlice([]string{
+						string(eventgrid.SystemAssigned),
+					}, false),
+				},
+			},
+		},
+	}
+}
+
+func expandEventGridExpirationTime(d *schema.ResourceData) (*date.Time, error) {
 	if expirationTimeUtc, ok := d.GetOk("expiration_time_utc"); ok {
 		if expirationTimeUtc == "" {
 			return nil, nil
@@ -1101,6 +1121,22 @@ func expandEventGridEventSubscriptionRetryPolicy(d *pluginsdk.ResourceData) *eve
 	return nil
 }
 
+func expandIdentity(input []interface{}) *eventgrid.EventSubscriptionIdentity {
+	if len(input) == 0 || input[0] == nil {
+		return &eventgrid.EventSubscriptionIdentity{
+			Type: eventgrid.EventSubscriptionIdentityType("None"),
+		}
+	}
+	identity := input[0].(map[string]interface{})
+	identityType := eventgrid.EventSubscriptionIdentityType(identity["type"].(string))
+
+	eventgridIdentity := eventgrid.EventSubscriptionIdentity{
+		Type: identityType,
+	}
+
+	return &eventgridIdentity
+}
+
 func flattenEventGridEventSubscriptionEventhubEndpoint(input *eventgrid.EventHubEventSubscriptionDestination) []interface{} {
 	if input == nil {
 		return nil
@@ -1446,3 +1482,15 @@ func flattenKey(inputKey *string) map[string]interface{} {
 		"key": key,
 	}
 }
+
+func flattenIdentity(input *eventgrid.EventSubscriptionIdentity) []interface{} {
+	if input == nil || string(input.Type) == "None" {
+		return []interface{}{}
+	}
+
+	return []interface{}{
+		map[string]interface{}{
+			"type": string(input.Type),
+		},
+	}
+}

internal/services/eventgrid/eventgrid_event_subscription_resource.go

@@ -140,6 +140,10 @@ func resourceEventGridEventSubscription() *pluginsdk.Resource {
 
 			"advanced_filter": eventSubscriptionSchemaAdvancedFilter(),
 
+			"delivery_identity": eventSubscriptionSchemaIdentity(),
+
+			"dead_letter_identity": eventSubscriptionSchemaIdentity(),
+
 			"storage_blob_dead_letter_destination": eventSubscriptionSchemaStorageBlobDeadletterDestination(),
 
 			"retry_policy": eventSubscriptionSchemaRetryPolicy(),
@@ -187,14 +191,39 @@ func resourceEventGridEventSubscriptionCreateUpdate(d *pluginsdk.ResourceData, m
 		return fmt.Errorf("creating/updating EventGrid Event Subscription %q (Scope %q): %s", name, scope, err)
 	}
 
+	deadLetterDestination := expandEventGridEventSubscriptionStorageBlobDeadLetterDestination(d)
+
 	eventSubscriptionProperties := eventgrid.EventSubscriptionProperties{
-		Destination:           destination,
-		Filter:                filter,
-		DeadLetterDestination: expandEventGridEventSubscriptionStorageBlobDeadLetterDestination(d),
-		RetryPolicy:           expandEventGridEventSubscriptionRetryPolicy(d),
-		Labels:                utils.ExpandStringSlice(d.Get("labels").([]interface{})),
-		EventDeliverySchema:   eventgrid.EventDeliverySchema(d.Get("event_delivery_schema").(string)),
-		ExpirationTimeUtc:     expirationTime,
+		Filter:              filter,
+		RetryPolicy:         expandEventGridEventSubscriptionRetryPolicy(d),
+		Labels:              utils.ExpandStringSlice(d.Get("labels").([]interface{})),
+		EventDeliverySchema: eventgrid.EventDeliverySchema(d.Get("event_delivery_schema").(string)),
+		ExpirationTimeUtc:   expirationTime,
+	}
+
+	if v, ok := d.GetOk("delivery_identity"); ok {
+		deliveryIdentityRaw := v.([]interface{})
+		deliveryIdentity := expandIdentity(deliveryIdentityRaw)
+		eventSubscriptionProperties.DeliveryWithResourceIdentity = &eventgrid.DeliveryWithResourceIdentity{
+			Identity:    deliveryIdentity,
+			Destination: destination,
+		}
+	} else {
+		eventSubscriptionProperties.Destination = destination
+	}
+
+	if v, ok := d.GetOk("dead_letter_identity"); ok {
+		if deadLetterDestination == nil {
+			return fmt.Errorf("`dead_letter_identity`: `storage_blob_dead_letter_destination` must be specified")
+		}
+		deadLetterIdentityRaw := v.([]interface{})
+		deadLetterIdentity := expandIdentity(deadLetterIdentityRaw)
+		eventSubscriptionProperties.DeadLetterWithResourceIdentity = &eventgrid.DeadLetterWithResourceIdentity{
+			Identity:              deadLetterIdentity,
+			DeadLetterDestination: deadLetterDestination,
+		}
+	} else {
+		eventSubscriptionProperties.DeadLetterDestination = deadLetterDestination
 	}
 
 	eventSubscription := eventgrid.EventSubscription{
@@ -256,12 +285,22 @@ func resourceEventGridEventSubscriptionRead(d *pluginsdk.ResourceData, meta inte
 
 		d.Set("event_delivery_schema", string(props.EventDeliverySchema))
 
-		if azureFunctionEndpoint, ok := props.Destination.AsAzureFunctionEventSubscriptionDestination(); ok {
+		destination := props.Destination
+		deliveryIdentityFlattened := make([]interface{}, 0)
+		if deliveryIdentity := props.DeliveryWithResourceIdentity; deliveryIdentity != nil {
+			destination = deliveryIdentity.Destination
+			deliveryIdentityFlattened = flattenIdentity(deliveryIdentity.Identity)
+		}
+		if err := d.Set("delivery_identity", deliveryIdentityFlattened); err != nil {
+			return fmt.Errorf("setting `delivery_identity` for EventGrid Event Subscription %q (Scope %q): %s", id.Name, id.Scope, err)
+		}
+
+		if azureFunctionEndpoint, ok := destination.AsAzureFunctionEventSubscriptionDestination(); ok {
 			if err := d.Set("azure_function_endpoint", flattenEventGridEventSubscriptionAzureFunctionEndpoint(azureFunctionEndpoint)); err != nil {
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "azure_function_endpoint", id.Name, id.Scope, err)
 			}
 		}
-		if v, ok := props.Destination.AsEventHubEventSubscriptionDestination(); ok {
+		if v, ok := destination.AsEventHubEventSubscriptionDestination(); ok {
 			if err := d.Set("eventhub_endpoint_id", v.ResourceID); err != nil {
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "eventhub_endpoint_id", id.Name, id.Scope, err)
 			}
@@ -270,7 +309,7 @@ func resourceEventGridEventSubscriptionRead(d *pluginsdk.ResourceData, meta inte
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "eventhub_endpoint", id.Name, id.Scope, err)
 			}
 		}
-		if v, ok := props.Destination.AsHybridConnectionEventSubscriptionDestination(); ok {
+		if v, ok := destination.AsHybridConnectionEventSubscriptionDestination(); ok {
 			if err := d.Set("hybrid_connection_endpoint_id", v.ResourceID); err != nil {
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "hybrid_connection_endpoint_id", id.Name, id.Scope, err)
 			}
@@ -279,22 +318,22 @@ func resourceEventGridEventSubscriptionRead(d *pluginsdk.ResourceData, meta inte
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "hybrid_connection_endpoint", id.Name, id.Scope, err)
 			}
 		}
-		if serviceBusQueueEndpoint, ok := props.Destination.AsServiceBusQueueEventSubscriptionDestination(); ok {
+		if serviceBusQueueEndpoint, ok := destination.AsServiceBusQueueEventSubscriptionDestination(); ok {
 			if err := d.Set("service_bus_queue_endpoint_id", serviceBusQueueEndpoint.ResourceID); err != nil {
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "service_bus_queue_endpoint_id", id.Name, id.Scope, err)
 			}
 		}
-		if serviceBusTopicEndpoint, ok := props.Destination.AsServiceBusTopicEventSubscriptionDestination(); ok {
+		if serviceBusTopicEndpoint, ok := destination.AsServiceBusTopicEventSubscriptionDestination(); ok {
 			if err := d.Set("service_bus_topic_endpoint_id", serviceBusTopicEndpoint.ResourceID); err != nil {
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "service_bus_topic_endpoint_id", id.Name, id.Scope, err)
 			}
 		}
-		if v, ok := props.Destination.AsStorageQueueEventSubscriptionDestination(); ok {
+		if v, ok := destination.AsStorageQueueEventSubscriptionDestination(); ok {
 			if err := d.Set("storage_queue_endpoint", flattenEventGridEventSubscriptionStorageQueueEndpoint(v)); err != nil {
 				return fmt.Errorf("setting `%q` for EventGrid Event Subscription %q (Scope %q): %s", "storage_queue_endpoint", id.Name, id.Scope, err)
 			}
 		}
-		if v, ok := props.Destination.AsWebHookEventSubscriptionDestination(); ok {
+		if v, ok := destination.AsWebHookEventSubscriptionDestination(); ok {
 			fullURL, err := client.GetFullURL(ctx, id.Scope, id.Name)
 			if err != nil {
 				return fmt.Errorf("making Read request on EventGrid Event Subscription full URL '%s': %+v", id.Name, err)
@@ -304,6 +343,24 @@ func resourceEventGridEventSubscriptionRead(d *pluginsdk.ResourceData, meta inte
 			}
 		}
 
+		deadLetterDestination := props.DeadLetterDestination
+		deadLetterIdentityFlattened := make([]interface{}, 0)
+		if deadLetterIdentity := props.DeadLetterWithResourceIdentity; deadLetterIdentity != nil {
+			deadLetterDestination = deadLetterIdentity.DeadLetterDestination
+			deadLetterIdentityFlattened = flattenIdentity(deadLetterIdentity.Identity)
+		}
+		if err := d.Set("dead_letter_identity", deadLetterIdentityFlattened); err != nil {
+			return fmt.Errorf("setting `dead_letter_identity` for EventGrid Event Subscription %q (Scope %q): %s", id.Name, id.Scope, err)
+		}
+
+		if deadLetterDestination != nil {
+			if storageBlobDeadLetterDestination, ok := deadLetterDestination.AsStorageBlobDeadLetterDestination(); ok {
+				if err := d.Set("storage_blob_dead_letter_destination", flattenEventGridEventSubscriptionStorageBlobDeadLetterDestination(storageBlobDeadLetterDestination)); err != nil {
+					return fmt.Errorf("Error setting `storage_blob_dead_letter_destination` for EventGrid Event Subscription %q (Scope %q): %s", id.Name, id.Scope, err)
+				}
+			}
+		}
+
 		if filter := props.Filter; filter != nil {
 			d.Set("included_event_types", filter.IncludedEventTypes)
 			d.Set("advanced_filtering_on_arrays_enabled", filter.EnableAdvancedFilteringOnArrays)

internal/services/eventgrid/eventgrid_event_subscription_resource_test.go

@@ -5,11 +5,11 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance/check"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/clients"
 	"github.com/hashicorp/terraform-provider-azurerm/internal/services/eventgrid/parse"
-	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
 	"github.com/hashicorp/terraform-provider-azurerm/utils"
 )
 
@@ -188,7 +188,46 @@ func TestAccEventGridEventSubscription_advancedFilterMaxItems(t *testing.T) {
 	})
 }
 
-func (EventGridEventSubscriptionResource) Exists(ctx context.Context, clients *clients.Client, state *pluginsdk.InstanceState) (*bool, error) {
+func TestAccEventGridEventSubscription_identity(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_eventgrid_event_subscription", "test")
+	r := EventGridEventSubscriptionResource{}
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.identity(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("delivery_identity.#").HasValue("1"),
+				check.That(data.ResourceName).Key("delivery_identity.0.type").HasValue("SystemAssigned"),
+				check.That(data.ResourceName).Key("dead_letter_identity.#").HasValue("1"),
+				check.That(data.ResourceName).Key("dead_letter_identity.0.type").HasValue("SystemAssigned"),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.basic(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("delivery_identity.#").HasValue("0"),
+				check.That(data.ResourceName).Key("dead_letter_identity.#").HasValue("0"),
+			),
+		},
+		data.ImportStep(),
+		{
+			Config: r.identity(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("delivery_identity.#").HasValue("1"),
+				check.That(data.ResourceName).Key("delivery_identity.0.type").HasValue("SystemAssigned"),
+				check.That(data.ResourceName).Key("dead_letter_identity.#").HasValue("1"),
+				check.That(data.ResourceName).Key("dead_letter_identity.0.type").HasValue("SystemAssigned"),
+			),
+		},
+		data.ImportStep(),
+	})
+}
+
+func (EventGridEventSubscriptionResource) Exists(ctx context.Context, clients *clients.Client, state *terraform.InstanceState) (*bool, error) {
 	id, err := parse.EventSubscriptionID(state.ID)
 	if err != nil {
 		return nil, err
@@ -723,3 +762,63 @@ resource "azurerm_eventgrid_event_subscription" "test" {
 }
 `, data.RandomInteger, data.Locations.Primary, data.RandomString)
 }
+
+func (EventGridEventSubscriptionResource) identity(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-eg-%[1]d"
+  location = "%[2]s"
+}
+
+resource "azurerm_storage_account" "test" {
+  name                     = "acctestacc%[3]s"
+  resource_group_name      = azurerm_resource_group.test.name
+  location                 = azurerm_resource_group.test.location
+  account_tier             = "Standard"
+  account_replication_type = "LRS"
+
+  tags = {
+    environment = "staging"
+  }
+}
+
+resource "azurerm_storage_queue" "test" {
+  name                 = "mysamplequeue-%[1]d"
+  storage_account_name = azurerm_storage_account.test.name
+}
+
+resource "azurerm_storage_container" "test" {
+  name                  = "dead-letter-destination"
+  storage_account_name  = azurerm_storage_account.test.name
+  container_access_type = "private"
+}
+
+resource "azurerm_eventgrid_event_subscription" "test" {
+  name  = "acctesteg-%[1]d"
+  scope = azurerm_resource_group.test.id
+
+  delivery_identity {
+    type = "SystemAssigned"
+  }
+
+  dead_letter_identity {
+    type = "SystemAssigned"
+  }
+
+  storage_queue_endpoint {
+    storage_account_id = azurerm_storage_account.test.id
+    queue_name         = azurerm_storage_queue.test.name
+  }
+
+  storage_blob_dead_letter_destination {
+    storage_account_id          = azurerm_storage_account.test.id
+    storage_blob_container_name = azurerm_storage_container.test.name
+  }
+
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomString)
+}