r/azurerm_virtual_network_gateway_connection: Add support for connection_mode argument

internal/services/network/virtual_network_gateway_connection_resource.go

@@ -149,6 +149,18 @@ func resourceVirtualNetworkGatewayConnection() *pluginsdk.Resource {
 				}, false),
 			},
 
+			"connection_mode": {
+				Type:     pluginsdk.TypeString,
+				Optional: true,
+				ForceNew: true,
+				ValidateFunc: validation.StringInSlice([]string{
+					string(network.VirtualNetworkGatewayConnectionModeInitiatorOnly),
+					string(network.VirtualNetworkGatewayConnectionModeResponderOnly),
+					string(network.VirtualNetworkGatewayConnectionModeDefault),
+				}, false),
+				Default: string(network.VirtualNetworkGatewayConnectionModeDefault),
+			},
+
 			"traffic_selector_policy": {
 				Type:     pluginsdk.TypeList,
 				Optional: true,
@@ -443,6 +455,8 @@ func resourceVirtualNetworkGatewayConnectionRead(d *pluginsdk.ResourceData, meta
 
 	d.Set("connection_protocol", string(conn.ConnectionProtocol))
 
+	d.Set("connection_mode", string(conn.ConnectionMode))
+
 	if conn.ExpressRouteGatewayBypass != nil {
 		d.Set("express_route_gateway_bypass", conn.ExpressRouteGatewayBypass)
 	}
@@ -487,9 +501,11 @@ func resourceVirtualNetworkGatewayConnectionDelete(d *pluginsdk.ResourceData, me
 
 func getVirtualNetworkGatewayConnectionProperties(d *pluginsdk.ResourceData) (*network.VirtualNetworkGatewayConnectionPropertiesFormat, error) {
 	connectionType := network.VirtualNetworkGatewayConnectionType(d.Get("type").(string))
+	connectionMode := network.VirtualNetworkGatewayConnectionMode(d.Get("connection_mode").(string))
 
 	props := &network.VirtualNetworkGatewayConnectionPropertiesFormat{
 		ConnectionType:                 connectionType,
+		ConnectionMode:                 connectionMode,
 		EnableBgp:                      utils.Bool(d.Get("enable_bgp").(bool)),
 		ExpressRouteGatewayBypass:      utils.Bool(d.Get("express_route_gateway_bypass").(bool)),
 		UsePolicyBasedTrafficSelectors: utils.Bool(d.Get("use_policy_based_traffic_selectors").(bool)),

internal/services/network/virtual_network_gateway_connection_resource_test.go

@@ -129,6 +129,22 @@ func TestAccVirtualNetworkGatewayConnection_connectionprotocol(t *testing.T) {
 	})
 }
 
+func TestAccVirtualNetworkGatewayConnection_ConnectionMode(t *testing.T) {
+	expectedConnectionMode := "InitiatorOnly"
+	data := acceptance.BuildTestData(t, "azurerm_virtual_network_gateway_connection", "test")
+	r := VirtualNetworkGatewayConnectionResource{}
+
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.connectionMode(data),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+				check.That(data.ResourceName).Key("connection_mode").HasValue(expectedConnectionMode),
+			),
+		},
+	})
+}
+
 func TestAccVirtualNetworkGatewayConnection_updatingSharedKey(t *testing.T) {
 	data1 := acceptance.BuildTestData(t, "azurerm_virtual_network_gateway_connection", "test_1")
 	data2 := acceptance.BuildTestData(t, "azurerm_virtual_network_gateway_connection", "test_2")
@@ -563,6 +579,91 @@ resource "azurerm_virtual_network_gateway_connection" "test" {
 `, data.RandomInteger, data.Locations.Primary)
 }
 
+func (VirtualNetworkGatewayConnectionResource) connectionMode(data acceptance.TestData) string {
+	return fmt.Sprintf(`
+variable "random" {
+  default = "%d"
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-${var.random}"
+  location = "%s"
+}
+
+resource "azurerm_virtual_network" "test" {
+  name                = "acctestvn-${var.random}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  address_space       = ["10.0.0.0/16"]
+}
+
+resource "azurerm_subnet" "test" {
+  name                 = "GatewaySubnet"
+  resource_group_name  = azurerm_resource_group.test.name
+  virtual_network_name = azurerm_virtual_network.test.name
+  address_prefix       = "10.0.1.0/24"
+}
+
+resource "azurerm_public_ip" "test" {
+  name                = "acctest-${var.random}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  allocation_method   = "Dynamic"
+}
+
+resource "azurerm_virtual_network_gateway" "test" {
+  name                = "acctest-${var.random}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+
+  type     = "Vpn"
+  vpn_type = "RouteBased"
+  sku      = "VpnGw1"
+
+  ip_configuration {
+    name                          = "vnetGatewayConfig"
+    public_ip_address_id          = azurerm_public_ip.test.id
+    private_ip_address_allocation = "Dynamic"
+    subnet_id                     = azurerm_subnet.test.id
+  }
+}
+
+resource "azurerm_local_network_gateway" "test" {
+  name                = "acctest-${var.random}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+
+  gateway_address = "168.62.225.23"
+  address_space   = ["10.1.1.0/24"]
+}
+
+resource "azurerm_virtual_network_gateway_connection" "test" {
+  name                = "acctest-${var.random}"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+
+  type                       = "IPsec"
+  virtual_network_gateway_id = azurerm_virtual_network_gateway.test.id
+  local_network_gateway_id   = azurerm_local_network_gateway.test.id
+
+  connection_mode = "InitiatorOnly"
+
+  ipsec_policy {
+    dh_group         = "DHGroup14"
+    ike_encryption   = "AES256"
+    ike_integrity    = "SHA256"
+    ipsec_encryption = "AES256"
+    ipsec_integrity  = "SHA256"
+    pfs_group        = "PFS2048"
+    sa_datasize      = 102400000
+    sa_lifetime      = 27000
+  }
+
+  shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
+}
+`, data.RandomInteger, data.Locations.Primary)
+}
+
 func (VirtualNetworkGatewayConnectionResource) connectionprotocol(data acceptance.TestData) string {
 	return fmt.Sprintf(`
 variable "random" {

website/docs/r/virtual_network_gateway_connection.html.markdown

@@ -247,6 +247,10 @@ The following arguments are supported:
 * `shared_key` - (Optional) The shared IPSec key. A key could be provided if a
     Site-to-Site, VNet-to-VNet or ExpressRoute connection is created.
 
+* `connection_mode` - (Optional) Connection mode to use. Possible
+values are `Default`, `InitiatorOnly` and `ResponderOnly`. Defaults to `Default`.
+Changing this value will force a resource to be created.
+
 * `connection_protocol` - (Optional) The IKE protocol version to use. Possible
     values are `IKEv1` and `IKEv2`. Defaults to `IKEv2`.
     Changing this value will force a resource to be created.