azurerm_storage_account - Supports updating immutability_policy

[magodo]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

Supports updating the immutability_policy, also adds some special handling on the state.

PR Checklist

• I have followed the guidelines in our Contributing Documentation.
• I have checked to ensure there aren't other open Pull Requests for the same update/change.
• I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
• I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
• I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
  For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

• I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
• I have written new tests for my resource or datasource changes & updated any relevent documentation.
• I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
• (For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

• My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

Test

$ TF_ACC=1 go test -v -timeout=20h -run='TestAccStorageAccount_[basic|immutabilityPolicy]' ./internal/services/storage
=== RUN   TestAccStorageAccount_basic
=== PAUSE TestAccStorageAccount_basic
=== RUN   TestAccStorageAccount_tagCount
=== PAUSE TestAccStorageAccount_tagCount
=== RUN   TestAccStorageAccount_blobConnectionString
=== PAUSE TestAccStorageAccount_blobConnectionString
=== RUN   TestAccStorageAccount_minTLSVersion
=== PAUSE TestAccStorageAccount_minTLSVersion
=== RUN   TestAccStorageAccount_isHnsEnabled
=== PAUSE TestAccStorageAccount_isHnsEnabled
=== RUN   TestAccStorageAccount_isHnsDisabled
=== PAUSE TestAccStorageAccount_isHnsDisabled
=== RUN   TestAccStorageAccount_isNFSv3Enabled
=== PAUSE TestAccStorageAccount_isNFSv3Enabled
=== RUN   TestAccStorageAccount_blobStorageWithUpdate
=== PAUSE TestAccStorageAccount_blobStorageWithUpdate
=== RUN   TestAccStorageAccount_blockBlobStorage
=== PAUSE TestAccStorageAccount_blockBlobStorage
=== RUN   TestAccStorageAccount_storageV2WithUpdate
=== PAUSE TestAccStorageAccount_storageV2WithUpdate
=== RUN   TestAccStorageAccount_storageV1ToV2Update
=== PAUSE TestAccStorageAccount_storageV1ToV2Update
=== RUN   TestAccStorageAccount_systemAssignedIdentity
=== PAUSE TestAccStorageAccount_systemAssignedIdentity
=== RUN   TestAccStorageAccount_userAssignedIdentity
=== PAUSE TestAccStorageAccount_userAssignedIdentity
=== RUN   TestAccStorageAccount_systemAssignedUserAssignedIdentity
=== PAUSE TestAccStorageAccount_systemAssignedUserAssignedIdentity
=== RUN   TestAccStorageAccount_updateResourceByEnablingIdentity
=== PAUSE TestAccStorageAccount_updateResourceByEnablingIdentity
=== RUN   TestAccStorageAccount_blobProperties
=== PAUSE TestAccStorageAccount_blobProperties
=== RUN   TestAccStorageAccount_blobProperties_containerAndLastAccessTimeDisabled
=== PAUSE TestAccStorageAccount_blobProperties_containerAndLastAccessTimeDisabled
=== RUN   TestAccStorageAccount_blobPropertiesEmptyAllowedExposedHeaders
=== PAUSE TestAccStorageAccount_blobPropertiesEmptyAllowedExposedHeaders
=== RUN   TestAccStorageAccount_blobProperties_kindStorageNotSupportLastAccessTimeEnabled
=== PAUSE TestAccStorageAccount_blobProperties_kindStorageNotSupportLastAccessTimeEnabled
=== RUN   TestAccStorageAccount_staticWebsiteEnabled
=== PAUSE TestAccStorageAccount_staticWebsiteEnabled
=== RUN   TestAccStorageAccount_staticWebsitePropertiesForStorageV2
=== PAUSE TestAccStorageAccount_staticWebsitePropertiesForStorageV2
=== RUN   TestAccStorageAccount_staticWebsitePropertiesForBlockBlobStorage
=== PAUSE TestAccStorageAccount_staticWebsitePropertiesForBlockBlobStorage
=== RUN   TestAccStorageAccount_largeFileShare
=== PAUSE TestAccStorageAccount_largeFileShare
=== RUN   TestAccStorageAccount_sharedKeyAccess
=== PAUSE TestAccStorageAccount_sharedKeyAccess
=== RUN   TestAccStorageAccount_sharedKeyAccessUnsupported
=== PAUSE TestAccStorageAccount_sharedKeyAccessUnsupported
=== RUN   TestAccStorageAccount_infrastructureEncryptionStorageV2_Enabled
=== PAUSE TestAccStorageAccount_infrastructureEncryptionStorageV2_Enabled
=== RUN   TestAccStorageAccount_infrastructureEncryptionStorageV2_Disabled
=== PAUSE TestAccStorageAccount_infrastructureEncryptionStorageV2_Disabled
=== RUN   TestAccStorageAccount_infrastructureEncryptionFileStorage
=== PAUSE TestAccStorageAccount_infrastructureEncryptionFileStorage
=== RUN   TestAccStorageAccount_infrastructureEncryptionBlockBlobStorage
=== PAUSE TestAccStorageAccount_infrastructureEncryptionBlockBlobStorage
=== RUN   TestAccStorageAccount_immutabilityPolicy_stateDisabled
=== PAUSE TestAccStorageAccount_immutabilityPolicy_stateDisabled
=== RUN   TestAccStorageAccount_immutabilityPolicy_stateUnlocked
=== PAUSE TestAccStorageAccount_immutabilityPolicy_stateUnlocked
=== RUN   TestAccStorageAccount_immutabilityPolicy_stateLocked
=== PAUSE TestAccStorageAccount_immutabilityPolicy_stateLocked
=== RUN   TestAccStorageAccount_immutabilityPolicy_stateDisabledLocked
=== PAUSE TestAccStorageAccount_immutabilityPolicy_stateDisabledLocked
=== RUN   TestAccStorageAccount_immutabilityPolicy_stateUnlockedDisabledUnLockedLocked
=== PAUSE TestAccStorageAccount_immutabilityPolicy_stateUnlockedDisabledUnLockedLocked
=== RUN   TestAccStorageAccount_immutabilityPolicy_stateLockedToUnlockedReplace
=== PAUSE TestAccStorageAccount_immutabilityPolicy_stateLockedToUnlockedReplace
=== RUN   TestAccStorageAccount_customerManagedKey
=== PAUSE TestAccStorageAccount_customerManagedKey
=== RUN   TestAccStorageAccount_customerManagedKeyForSUAI
=== PAUSE TestAccStorageAccount_customerManagedKeyForSUAI
=== RUN   TestAccStorageAccount_customerManagedKeyAutoRotation
=== PAUSE TestAccStorageAccount_customerManagedKeyAutoRotation
=== RUN   TestAccStorageAccount_customerManagedKeyUpdated
=== PAUSE TestAccStorageAccount_customerManagedKeyUpdated
=== RUN   TestAccStorageAccount_customerManagedKeyRemoteKeyVault
=== PAUSE TestAccStorageAccount_customerManagedKeyRemoteKeyVault
=== RUN   TestAccStorageAccount_updateToUsingIdentityAndCustomerManagedKey
=== PAUSE TestAccStorageAccount_updateToUsingIdentityAndCustomerManagedKey
=== RUN   TestAccStorageAccount_customerManagedKeyForHSM
    storage_account_resource_test.go:1574: Skipping as ARM_TEST_HSM_KEY is not specified
--- SKIP: TestAccStorageAccount_customerManagedKeyForHSM (0.00s)
=== RUN   TestAccStorageAccount_storageV1StandardZRS
=== PAUSE TestAccStorageAccount_storageV1StandardZRS
=== RUN   TestAccStorageAccount_smbMultichannel
=== PAUSE TestAccStorageAccount_smbMultichannel
=== RUN   TestAccStorageAccount_sasPolicy
=== PAUSE TestAccStorageAccount_sasPolicy
=== RUN   TestAccStorageAccount_allowedCopyScope
=== PAUSE TestAccStorageAccount_allowedCopyScope
=== RUN   TestAccStorageAccount_isSftpEnabled
=== PAUSE TestAccStorageAccount_isSftpEnabled
=== RUN   TestAccStorageAccount_isLocalUserEnabled
=== PAUSE TestAccStorageAccount_isLocalUserEnabled
=== RUN   TestAccStorageAccount_minimalShareProperties
=== PAUSE TestAccStorageAccount_minimalShareProperties
=== RUN   TestAccStorageAccount_minimalSharePropertiesPremiumFileStorage
=== PAUSE TestAccStorageAccount_minimalSharePropertiesPremiumFileStorage
=== RUN   TestAccStorageAccount_invalidAccountKindForAccessTier
=== PAUSE TestAccStorageAccount_invalidAccountKindForAccessTier
=== CONT  TestAccStorageAccount_basic
=== CONT  TestAccStorageAccount_infrastructureEncryptionStorageV2_Enabled
=== CONT  TestAccStorageAccount_customerManagedKeyUpdated
=== CONT  TestAccStorageAccount_systemAssignedUserAssignedIdentity
=== CONT  TestAccStorageAccount_largeFileShare
=== CONT  TestAccStorageAccount_blobProperties_containerAndLastAccessTimeDisabled
=== CONT  TestAccStorageAccount_allowedCopyScope
=== CONT  TestAccStorageAccount_minimalShareProperties
=== CONT  TestAccStorageAccount_blobStorageWithUpdate
=== CONT  TestAccStorageAccount_invalidAccountKindForAccessTier
=== CONT  TestAccStorageAccount_storageV1StandardZRS
=== CONT  TestAccStorageAccount_blobProperties_kindStorageNotSupportLastAccessTimeEnabled
=== CONT  TestAccStorageAccount_staticWebsiteEnabled
=== CONT  TestAccStorageAccount_sharedKeyAccessUnsupported
=== CONT  TestAccStorageAccount_sharedKeyAccess
=== CONT  TestAccStorageAccount_storageV1ToV2Update
--- PASS: TestAccStorageAccount_invalidAccountKindForAccessTier (43.90s)
=== CONT  TestAccStorageAccount_isLocalUserEnabled
--- PASS: TestAccStorageAccount_sharedKeyAccessUnsupported (87.69s)
=== CONT  TestAccStorageAccount_isSftpEnabled
--- PASS: TestAccStorageAccount_storageV1StandardZRS (115.16s)
=== CONT  TestAccStorageAccount_customerManagedKeyAutoRotation
--- PASS: TestAccStorageAccount_blobStorageWithUpdate (141.69s)
=== CONT  TestAccStorageAccount_customerManagedKeyForSUAI
--- PASS: TestAccStorageAccount_blobProperties_kindStorageNotSupportLastAccessTimeEnabled (144.00s)
=== CONT  TestAccStorageAccount_customerManagedKey
--- PASS: TestAccStorageAccount_infrastructureEncryptionStorageV2_Enabled (153.13s)
=== CONT  TestAccStorageAccount_immutabilityPolicy_stateLockedToUnlockedReplace
--- PASS: TestAccStorageAccount_systemAssignedUserAssignedIdentity (153.41s)
=== CONT  TestAccStorageAccount_immutabilityPolicy_stateUnlockedDisabledUnLockedLocked
--- PASS: TestAccStorageAccount_minimalShareProperties (158.20s)
=== CONT  TestAccStorageAccount_immutabilityPolicy_stateDisabledLocked
--- PASS: TestAccStorageAccount_storageV1ToV2Update (197.17s)
=== CONT  TestAccStorageAccount_immutabilityPolicy_stateLocked
--- PASS: TestAccStorageAccount_immutabilityPolicy_stateLocked (1.03s)
=== CONT  TestAccStorageAccount_immutabilityPolicy_stateUnlocked
--- PASS: TestAccStorageAccount_blobProperties_containerAndLastAccessTimeDisabled (207.19s)
=== CONT  TestAccStorageAccount_storageV2WithUpdate
--- PASS: TestAccStorageAccount_basic (214.99s)
=== CONT  TestAccStorageAccount_immutabilityPolicy_stateDisabled
--- PASS: TestAccStorageAccount_largeFileShare (239.92s)
=== CONT  TestAccStorageAccount_infrastructureEncryptionBlockBlobStorage
--- PASS: TestAccStorageAccount_allowedCopyScope (382.19s)
=== CONT  TestAccStorageAccount_infrastructureEncryptionFileStorage
--- PASS: TestAccStorageAccount_isSftpEnabled (299.85s)
=== CONT  TestAccStorageAccount_infrastructureEncryptionStorageV2_Disabled
--- PASS: TestAccStorageAccount_sharedKeyAccess (387.99s)
=== CONT  TestAccStorageAccount_sasPolicy
--- PASS: TestAccStorageAccount_staticWebsiteEnabled (389.43s)
=== CONT  TestAccStorageAccount_smbMultichannel
--- PASS: TestAccStorageAccount_isLocalUserEnabled (366.42s)
=== CONT  TestAccStorageAccount_staticWebsitePropertiesForBlockBlobStorage
--- PASS: TestAccStorageAccount_infrastructureEncryptionBlockBlobStorage (183.96s)
=== CONT  TestAccStorageAccount_staticWebsitePropertiesForStorageV2
--- PASS: TestAccStorageAccount_immutabilityPolicy_stateDisabledLocked (268.10s)
=== CONT  TestAccStorageAccount_minimalSharePropertiesPremiumFileStorage
--- PASS: TestAccStorageAccount_immutabilityPolicy_stateUnlocked (252.82s)
=== CONT  TestAccStorageAccount_userAssignedIdentity
--- PASS: TestAccStorageAccount_immutabilityPolicy_stateDisabled (238.66s)
=== CONT  TestAccStorageAccount_blobProperties
--- PASS: TestAccStorageAccount_storageV2WithUpdate (283.96s)
=== CONT  TestAccStorageAccount_blobPropertiesEmptyAllowedExposedHeaders
--- PASS: TestAccStorageAccount_infrastructureEncryptionFileStorage (120.51s)
=== CONT  TestAccStorageAccount_isHnsEnabled
--- PASS: TestAccStorageAccount_customerManagedKeyAutoRotation (411.31s)
=== CONT  TestAccStorageAccount_isNFSv3Enabled
--- PASS: TestAccStorageAccount_minimalSharePropertiesPremiumFileStorage (102.63s)
=== CONT  TestAccStorageAccount_isHnsDisabled
--- PASS: TestAccStorageAccount_infrastructureEncryptionStorageV2_Disabled (148.72s)
=== CONT  TestAccStorageAccount_updateResourceByEnablingIdentity
--- PASS: TestAccStorageAccount_smbMultichannel (156.71s)
=== CONT  TestAccStorageAccount_blobConnectionString
--- PASS: TestAccStorageAccount_immutabilityPolicy_stateLockedToUnlockedReplace (395.46s)
=== CONT  TestAccStorageAccount_minTLSVersion
--- PASS: TestAccStorageAccount_customerManagedKeyForSUAI (415.61s)
=== CONT  TestAccStorageAccount_systemAssignedIdentity
--- PASS: TestAccStorageAccount_customerManagedKey (423.08s)
=== CONT  TestAccStorageAccount_updateToUsingIdentityAndCustomerManagedKey
--- PASS: TestAccStorageAccount_immutabilityPolicy_stateUnlockedDisabledUnLockedLocked (414.47s)
=== CONT  TestAccStorageAccount_customerManagedKeyRemoteKeyVault
    testcase.go:173: Step 1/3 error: Error running pre-apply plan: exit status 1
    Error: `subscription_id` is a required provider property when performing a plan/apply operation

      with provider["registry.terraform.io/hashicorp/azurerm-alt"],
      on terraform_plugin_test.tf line 31, in provider "azurerm-alt":
      31: provider "azurerm-alt" {

--- FAIL: TestAccStorageAccount_customerManagedKeyRemoteKeyVault (1.10s)

=== CONT  TestAccStorageAccount_tagCount

--- PASS: TestAccStorageAccount_staticWebsitePropertiesForBlockBlobStorage (264.62s)

=== CONT  TestAccStorageAccount_blockBlobStorage

--- PASS: TestAccStorageAccount_userAssignedIdentity (242.86s)

--- PASS: TestAccStorageAccount_sasPolicy (310.80s)

--- PASS: TestAccStorageAccount_blobPropertiesEmptyAllowedExposedHeaders (212.48s)

--- PASS: TestAccStorageAccount_staticWebsitePropertiesForStorageV2 (310.60s)

--- PASS: TestAccStorageAccount_blobConnectionString (189.59s)

--- PASS: TestAccStorageAccount_systemAssignedIdentity (179.40s)

--- PASS: TestAccStorageAccount_isHnsEnabled (235.63s)

--- PASS: TestAccStorageAccount_isNFSv3Enabled (227.64s)

--- PASS: TestAccStorageAccount_isHnsDisabled (226.80s)

--- PASS: TestAccStorageAccount_tagCount (189.59s)

--- PASS: TestAccStorageAccount_customerManagedKeyUpdated (775.38s)

--- PASS: TestAccStorageAccount_blockBlobStorage (118.08s)

--- PASS: TestAccStorageAccount_updateResourceByEnablingIdentity (316.20s)

--- PASS: TestAccStorageAccount_blobProperties (418.37s)

--- PASS: TestAccStorageAccount_updateToUsingIdentityAndCustomerManagedKey (390.30s)

--- PASS: TestAccStorageAccount_minTLSVersion (414.65s)

FAIL

FAIL    github.com/hashicorp/terraform-provider-azurerm/internal/services/storage       963.273s

FAIL

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

• azurerm_storage_account - Supports updating immutability_policy [GH-00000]

This is a (please select all that apply):

• Bug Fix
• New Feature (ie adding a service, resource, or data source)
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #23435

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

[stephybun]

Thanks for this PR @magodo. The block in the schema is still marked as ForceNew

terraform-provider-azurerm/internal/services/storage/storage_account_resource.go

Lines 276 to 281 in 94bae58

	"immutability_policy": {
	Type: pluginsdk.TypeList,
	Optional: true,
	MaxItems: 1,
	ForceNew: true,
	Elem: &pluginsdk.Resource{

Should that be removed?

[magodo]

@stephybun Since test case TestAccStorageAccount_immutabilityPolicy_stateUnlockedDisabledUnLockedLocked got passed, which means no resource being recreated (otherwise it will fail). We can see that top level ForceNew won't be inherited to the including attributes.

On the other hand, setting/removing the immutability_policy is not supported by the API, that should be the reason the ForceNew is set at this level.

Meanwhile, I've resolved the merge conflict.

[stephybun]

Thanks @magodo LGTM 🌶️