Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add storage permission to KV access policy resource #3153

Merged
merged 2 commits into from
Apr 8, 2019
Merged

Add storage permission to KV access policy resource #3153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f96bfe7
Add storage permission to KV access policy resource
uberrich Mar 29, 2019
663ffd6
r/key_vault_access_policy: adding a test/docs for the `storage_permis…
tombuildsstuff Apr 6, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions azurerm/resource_arm_key_vault_access_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,8 @@ func resourceArmKeyVaultAccessPolicy() *schema.Resource {
"key_permissions": azure.SchemaKeyVaultKeyPermissions(),

"secret_permissions": azure.SchemaKeyVaultSecretPermissions(),

"storage_permissions": azure.SchemaKeyVaultStoragePermissions(),
tombuildsstuff marked this conversation as resolved.
Show resolved Hide resolved
},
}
}
Expand Down Expand Up @@ -208,13 +210,17 @@ func resourceArmKeyVaultAccessPolicyCreateOrDelete(d *schema.ResourceData, meta
secretPermissionsRaw := d.Get("secret_permissions").([]interface{})
secretPermissions := azure.ExpandSecretPermissions(secretPermissionsRaw)

storagePermissionsRaw := d.Get("storage_permissions").([]interface{})
storagePermissions := azure.ExpandStoragePermissions(storagePermissionsRaw)

accessPolicy := keyvault.AccessPolicyEntry{
ObjectID: utils.String(objectId),
TenantID: &tenantId,
Permissions: &keyvault.Permissions{
Certificates: certPermissions,
Keys: keyPermissions,
Secrets: secretPermissions,
Storage: storagePermissions,
},
}

Expand Down Expand Up @@ -332,6 +338,11 @@ func resourceArmKeyVaultAccessPolicyRead(d *schema.ResourceData, meta interface{
if err := d.Set("secret_permissions", secretPermissions); err != nil {
return fmt.Errorf("Error setting `secret_permissions`: %+v", err)
}

storagePermissions := azure.FlattenStoragePermissions(permissions.Storage)
if err := d.Set("storage_permissions", storagePermissions); err != nil {
return fmt.Errorf("Error setting `storage_permissions`: %+v", err)
}
}

return nil
Expand Down
17 changes: 17 additions & 0 deletions azurerm/resource_arm_key_vault_access_policy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -352,6 +352,23 @@ resource "azurerm_key_vault_access_policy" "test_no_application_id" {
"delete",
]

storage_permissions = [
"backup",
"delete",
"deletesas",
"get",
"getsas",
"list",
"listsas",
"purge",
"recover",
"regeneratekey",
"restore",
"set",
"setsas",
"update",
]

tenant_id = "${data.azurerm_client_config.current.tenant_id}"
object_id = "${data.azurerm_client_config.current.service_principal_object_id}"
}
Expand Down
2 changes: 2 additions & 0 deletions website/docs/r/key_vault_access_policy.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,8 @@ The following arguments are supported:
* `secret_permissions` - (Required) List of secret permissions, must be one or more
from the following: `backup`, `delete`, `get`, `list`, `purge`, `recover`, `restore` and `set`.

* `storage_permissions` - (Optional) List of storage permissions, must be one or more from the following: `backup`, `delete`, `deletesas`, `get`, `getsas`, `list`, `listsas`, `purge`, `recover`, `regeneratekey`, `restore`, `set`, `setsas` and `update`.

## Attributes Reference

The following attributes are exported:
Expand Down