Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Storage Account: Enable DefaultAction in Network rules. #3255

Merged
merged 8 commits into from
Jun 26, 2019
Merged

Storage Account: Enable DefaultAction in Network rules. #3255

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
03e80b4
added default_action variable for network_rules block in storage account
thatInfrastructureGuy Apr 16, 2019
2773e5b
indentation fix
thatInfrastructureGuy Apr 16, 2019
d96aa1f
updated test to reflect firewall changes
thatInfrastructureGuy Apr 16, 2019
15d9564
As per review: Made default_action required variable.
thatInfrastructureGuy Apr 16, 2019
f8cb943
Change iprules and networkrules as computed variables.
thatInfrastructureGuy May 2, 2019
d750e99
suggested changed
katbyte May 19, 2019
7dd9802
Merge branch 'master' into storageaccount/vnet
katbyte May 24, 2019
7772872
Merge branch 'master' into storageaccount/vnet
katbyte May 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions azurerm/resource_arm_storage_account.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,15 +176,25 @@ func resourceArmStorageAccount() *schema.Resource {
"ip_rules": {
Type: schema.TypeSet,
Optional: true,
Computed: true,
Elem: &schema.Schema{Type: schema.TypeString},
Set: schema.HashString,
},
"virtual_network_subnet_ids": {
Type: schema.TypeSet,
Optional: true,
Computed: true,
Elem: &schema.Schema{Type: schema.TypeString},
Set: schema.HashString,
},
"default_action": {
Type: schema.TypeString,
Required: true,
ValidateFunc: validation.StringInSlice([]string{
string(storage.DefaultActionAllow),
string(storage.DefaultActionDeny),
}, false),
},
},
},
},
Expand Down Expand Up @@ -909,6 +919,11 @@ func expandStorageAccountNetworkRules(d *schema.ResourceData) *storage.NetworkRu
networkRule := networkRules[0].(map[string]interface{})
networkRuleSet := &storage.NetworkRuleSet{}

if networkRule["default_action"].(string) == string(storage.DefaultActionAllow) {
// If Default Access is enabled then no network rules are set.
thatInfrastructureGuy marked this conversation as resolved.
Show resolved Hide resolved
return &storage.NetworkRuleSet{DefaultAction: storage.DefaultActionAllow}
}

networkRuleSet.IPRules = expandStorageAccountIPRules(networkRule)
networkRuleSet.VirtualNetworkRules = expandStorageAccountVirtualNetworks(networkRule)
networkRuleSet.Bypass = expandStorageAccountBypass(networkRule)
Expand Down Expand Up @@ -970,6 +985,7 @@ func flattenStorageAccountNetworkRules(input *storage.NetworkRuleSet) []interfac
networkRules["ip_rules"] = schema.NewSet(schema.HashString, flattenStorageAccountIPRules(input.IPRules))
networkRules["virtual_network_subnet_ids"] = schema.NewSet(schema.HashString, flattenStorageAccountVirtualNetworks(input.VirtualNetworkRules))
networkRules["bypass"] = schema.NewSet(schema.HashString, flattenStorageAccountBypass(input.Bypass))
networkRules["default_action"] = string(input.DefaultAction)

return []interface{}{networkRules}
}
Expand Down
57 changes: 52 additions & 5 deletions azurerm/resource_arm_storage_account_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -543,6 +543,7 @@ func TestAccAzureRMStorageAccount_networkRules(t *testing.T) {
Config: preConfig,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMStorageAccountExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.default_action", "Deny"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.ip_rules.#", "1"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.virtual_network_subnet_ids.#", "1"),
),
Expand All @@ -556,8 +557,9 @@ func TestAccAzureRMStorageAccount_networkRules(t *testing.T) {
Config: postConfig,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMStorageAccountExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.default_action", "Deny"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.ip_rules.#", "2"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.virtual_network_subnet_ids.#", "0"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.virtual_network_subnet_ids.#", "1"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.bypass.#", "2"),
),
},
Expand All @@ -571,7 +573,7 @@ func TestAccAzureRMStorageAccount_networkRulesDeleted(t *testing.T) {
rs := acctest.RandString(4)
location := testLocation()
preConfig := testAccAzureRMStorageAccount_networkRules(ri, rs, location)
postConfig := testAccAzureRMStorageAccount_basic(ri, rs, location)
postConfig := testAccAzureRMStorageAccount_networkRulesReverted(ri, rs, location)

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Expand All @@ -582,6 +584,7 @@ func TestAccAzureRMStorageAccount_networkRulesDeleted(t *testing.T) {
Config: preConfig,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMStorageAccountExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.default_action", "Deny"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.ip_rules.#", "1"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.virtual_network_subnet_ids.#", "1"),
),
Expand All @@ -590,7 +593,7 @@ func TestAccAzureRMStorageAccount_networkRulesDeleted(t *testing.T) {
Config: postConfig,
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMStorageAccountExists(resourceName),
resource.TestCheckResourceAttr(resourceName, "network_rules.#", "0"),
resource.TestCheckResourceAttr(resourceName, "network_rules.0.default_action", "Allow"),
),
},
},
Expand Down Expand Up @@ -1103,6 +1106,7 @@ resource "azurerm_storage_account" "testsa" {
account_replication_type = "LRS"

network_rules {
default_action = "Deny"
ip_rules = ["127.0.0.1"]
virtual_network_subnet_ids = ["${azurerm_subnet.test.id}"]
}
Expand Down Expand Up @@ -1144,8 +1148,51 @@ resource "azurerm_storage_account" "testsa" {
account_replication_type = "LRS"

network_rules {
ip_rules = ["127.0.0.1", "127.0.0.2"]
bypass = ["Logging", "Metrics"]
default_action = "Deny"
ip_rules = ["127.0.0.1", "127.0.0.2"]
bypass = ["Logging", "Metrics"]
}

tags = {
environment = "production"
}
}
`, rInt, location, rInt, rInt, rString)
}

func testAccAzureRMStorageAccount_networkRulesReverted(rInt int, rString string, location string) string {
return fmt.Sprintf(`
resource "azurerm_resource_group" "testrg" {
name = "acctestAzureRMSA-%d"
location = "%s"
}

resource "azurerm_virtual_network" "test" {
name = "acctestvirtnet%d"
address_space = ["10.0.0.0/16"]
location = "${azurerm_resource_group.testrg.location}"
resource_group_name = "${azurerm_resource_group.testrg.name}"
}

resource "azurerm_subnet" "test" {
name = "acctestsubnet%d"
resource_group_name = "${azurerm_resource_group.testrg.name}"
virtual_network_name = "${azurerm_virtual_network.test.name}"
address_prefix = "10.0.2.0/24"
service_endpoints = ["Microsoft.Storage"]
}

resource "azurerm_storage_account" "testsa" {
name = "unlikely23exst2acct%s"
resource_group_name = "${azurerm_resource_group.testrg.name}"
location = "${azurerm_resource_group.testrg.location}"
account_tier = "Standard"
account_replication_type = "LRS"

network_rules {
default_action = "Allow"
ip_rules = ["127.0.0.1"]
virtual_network_subnet_ids = ["${azurerm_subnet.test.id}"]
}

tags = {
Expand Down
4 changes: 3 additions & 1 deletion website/docs/r/storage_account.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ resource "azurerm_storage_account" "testsa" {
account_replication_type = "LRS"

network_rules {
default_action = "Deny"
ip_rules = ["100.0.0.1"]
virtual_network_subnet_ids = ["${azurerm_subnet.test.id}"]
}
Expand Down Expand Up @@ -127,12 +128,13 @@ The following arguments are supported:

* `network_rules` supports the following:

* `default_action` - (Required) Specifies the default action of allow or deny when no other rules match. Valid options are `Deny` or `Allow`.
* `bypass` - (Optional) Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Valid options are
any combination of `Logging`, `Metrics`, `AzureServices`, or `None`.
* `ip_rules` - (Optional) List of public IP or IP ranges in CIDR Format. Only IPV4 addresses are allowed. Private IP address ranges (as defined in [RFC 1918](https://tools.ietf.org/html/rfc1918#section-3)) are not allowed.
* `virtual_network_subnet_ids` - (Optional) A list of resource ids for subnets.

~> **Note:** If specifying `network_rules`, one of either `ip_rules` or `virtual_network_subnet_ids` must be specified.
~> **Note:** If specifying `network_rules`, one of either `ip_rules` or `virtual_network_subnet_ids` must be specified and `default_action` must be set to `Deny`.

~> **Note:** [More information on Validation is available here](https://docs.microsoft.com/en-gb/azure/storage/blobs/storage-custom-domain-name)

Expand Down