azurerm_cognitive_account: allows bypass property for network_acls

[feliperezende-barbosa]

Community Note

• Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

This PR implements the network_acls.bypass property for azurerm_coginitive_account. Azure Services for Azure OpenAI

PR Checklist

• I have followed the guidelines in our Contributing Documentation.
• I have checked to ensure there aren't other open Pull Requests for the same update/change.
• I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
• I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
• I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
  For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

• I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
• I have written new tests for my resource or datasource changes & updated any relevent documentation.
• I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
• (For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

• My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

==> Checking that code complies with gofmt requirements...
==> Checking that Custom Timeouts are used...
==> Checking that acceptance test packages are used...
TF_ACC=1 go test -v ./internal/services/cognitive -run=TestAccCognitiveAccount_networkAcls -timeout 60m -ldflags="-X=github.com/hashicorp/terraform-provider-azurerm/version.ProviderVersion=acc"
=== RUN   TestAccCognitiveAccount_networkAclsVirtualNetworkRules
=== PAUSE TestAccCognitiveAccount_networkAclsVirtualNetworkRules
=== RUN   TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass
=== PAUSE TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass
=== RUN   TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported
=== PAUSE TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported
=== RUN   TestAccCognitiveAccount_networkAcls
=== PAUSE TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAclsVirtualNetworkRules
=== CONT  TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported
=== CONT  TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass
--- PASS: TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported (137.85s)
--- PASS: TestAccCognitiveAccount_networkAcls (216.38s)
--- PASS: TestAccCognitiveAccount_networkAclsVirtualNetworkRules (226.20s)
--- PASS: TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass (258.18s)
PASS
ok  	github.com/hashicorp/terraform-provider-azurerm/internal/services/cognitive	259.848s

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

• azurerm_cognitive_account - support for the bypass trusted Azure Services property [GH-28221]

This is a (please select all that apply):

• Bug Fix
• New Feature (ie adding a service, resource, or data source)
• Enhancement
• Breaking Change

Related Issue(s)

Fixes #28304

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

[catriona-m]

Thanks for this @feliperezende-barbos. This is looking good so far. Could we also add additional test steps to set this to AzureServices and back to None so we can confirm that updating this property works as expected? Thanks!

[feliperezende-barbosa]

Thanks for this @feliperezende-barbos. This is looking good so far. Could we also add additional test steps to set this to AzureServices and back to None so we can confirm that updating this property works as expected? Thanks!

Sure, I just added one more validation test for bypass property to back from AzureServices to None. Thanks.

[catriona-m]

Thanks for updating the tests @feliperezende-barbosa. I had a look at the results and it appears we have a failure, but once that is addressed I can take another look. Thanks!

------- Stdout: -------
=== RUN   TestAccCognitiveAccount_networkAcls
=== PAUSE TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAcls
    testcase.go:173: Step 1/6 error: Error running apply: exit status 1
        Error: creating Account (Subscription: "*******"
        Resource Group Name: "acctestRG-cognitive-241219155302861835"
        Account Name: "acctestcogacc-241219155302861835"): unexpected status 400 (400 Bad Request) with error: NetworkAclsBypassNotSupported: The Kind 'Face' does not support Trusted Services.
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 68, in resource "azurerm_cognitive_account" "test":
          68: resource "azurerm_cognitive_account" "test" {
--- FAIL: TestAccCognitiveAccount_networkAcls (177.11s)
FAIL

[feliperezende-barbosa]

Thanks for updating the tests @feliperezende-barbosa. I had a look at the results and it appears we have a failure, but once that is addressed I can take another look. Thanks!

------- Stdout: -------
=== RUN   TestAccCognitiveAccount_networkAcls
=== PAUSE TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAcls
    testcase.go:173: Step 1/6 error: Error running apply: exit status 1
        Error: creating Account (Subscription: "*******"
        Resource Group Name: "acctestRG-cognitive-241219155302861835"
        Account Name: "acctestcogacc-241219155302861835"): unexpected status 400 (400 Bad Request) with error: NetworkAclsBypassNotSupported: The Kind 'Face' does not support Trusted Services.
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 68, in resource "azurerm_cognitive_account" "test":
          68: resource "azurerm_cognitive_account" "test" {
--- FAIL: TestAccCognitiveAccount_networkAcls (177.11s)
FAIL

I realized you had tested the TestAccCognitiveAccount_networkAcls instead of TestAccCognitiveAccount_networkAclsVirtualNetworkRules. The problem was caused because the bypass property works for the Kind OpenAI and not for the Kind Face as you can see in the error: Account Name: "acctestcogacc-241219155302861835"): unexpected status 400 (400 Bad Request) with error: NetworkAclsBypassNotSupported: The Kind 'Face' does not support Trusted Services. That's why I've changed the Kind from Face to OpenAI in TestAccCognitiveAccount_networkAclsVirtualNetworkRules. You can check it out in this link.
I fixed the TestAccCognitiveAccount_networkAcls because both tests are related.
I've updated the PR in Testing section with the test results I've performed for both scenarios.

[catriona-m]

Thanks for updating the tests @feliperezende-barbosa. I had a look at the results and it appears we have a failure, but once that is addressed I can take another look. Thanks!

------- Stdout: -------
=== RUN   TestAccCognitiveAccount_networkAcls
=== PAUSE TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAcls
    testcase.go:173: Step 1/6 error: Error running apply: exit status 1
        Error: creating Account (Subscription: "*******"
        Resource Group Name: "acctestRG-cognitive-241219155302861835"
        Account Name: "acctestcogacc-241219155302861835"): unexpected status 400 (400 Bad Request) with error: NetworkAclsBypassNotSupported: The Kind 'Face' does not support Trusted Services.
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 68, in resource "azurerm_cognitive_account" "test":
          68: resource "azurerm_cognitive_account" "test" {
--- FAIL: TestAccCognitiveAccount_networkAcls (177.11s)
FAIL

I realized you had tested the TestAccCognitiveAccount_networkAcls instead of TestAccCognitiveAccount_networkAclsVirtualNetworkRules. The problem was caused because the bypass property works for the Kind OpenAI and not for the Kind Face as you can see in the error: Account Name: "acctestcogacc-241219155302861835"): unexpected status 400 (400 Bad Request) with error: NetworkAclsBypassNotSupported: The Kind 'Face' does not support Trusted Services. That's why I've changed the Kind from Face to OpenAI in TestAccCognitiveAccount_networkAclsVirtualNetworkRules. You can check it out in this link. I fixed the TestAccCognitiveAccount_networkAcls because both tests are related. I've updated the PR in Testing section with the test results I've performed for both scenarios.

Thanks for your reply @feliperezende-barbosa. My concern is that adding this property seems to be affecting existing configurations which are not using the bypass property and which previously worked without error beforehand. Would you be able to take another look at fixing this up? Thanks!

[feliperezende-barbosa]

Thanks @catriona-m, it had the risk of affecting the existing configurations that are not using and do not support it. I've added more tests and one more validating an error that does not support the bypass property. Could you please take a look again? Thanks again.

Results of the tests:

==> Checking that code complies with gofmt requirements...
==> Checking that Custom Timeouts are used...
==> Checking that acceptance test packages are used...
TF_ACC=1 go test -v ./internal/services/cognitive -run=TestAccCognitiveAccount_networkAcls -timeout 60m -ldflags="-X=github.com/hashicorp/terraform-provider-azurerm/version.ProviderVersion=acc"
=== RUN   TestAccCognitiveAccount_networkAclsVirtualNetworkRules
=== PAUSE TestAccCognitiveAccount_networkAclsVirtualNetworkRules
=== RUN   TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass
=== PAUSE TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass
=== RUN   TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported
=== PAUSE TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported
=== RUN   TestAccCognitiveAccount_networkAcls
=== PAUSE TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAclsVirtualNetworkRules
=== CONT  TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported
=== CONT  TestAccCognitiveAccount_networkAcls
=== CONT  TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass
--- PASS: TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypassKindNotSupported (137.85s)
--- PASS: TestAccCognitiveAccount_networkAcls (216.38s)
--- PASS: TestAccCognitiveAccount_networkAclsVirtualNetworkRules (226.20s)
--- PASS: TestAccCognitiveAccount_networkAclsVirtualNetworkRulesWithBypass (258.18s)
PASS
ok  	github.com/hashicorp/terraform-provider-azurerm/internal/services/cognitive	259.848s

[catriona-m]

Thanks for updating this @feliperezende-barbosa - I have left one query inline but I can take another look once that is addressed. Thanks!

[catriona-m]

Thanks for updating this @feliperezende-barbosa - I have left one query inline but I can take another look once that is addressed. Thanks!

Hi @catriona-m, I cannot see any query inline. Could you please check this out? Thanks

Sorry about that @feliperezende-barbosa - not sure how it got lost, but I've added the comment again now!

[catriona-m]

Thanks for updating this @feliperezende-barbosa - I had another look through and left a couple more suggestions for you to consider, let me know what you think. Thanks!

[feliperezende-barbosa]

Thanks for updating this @feliperezende-barbosa - I had another look through and left a couple more suggestions for you to consider, let me know what you think. Thanks!

Thanks for the suggestions. I've applied them.

[catriona-m]

Thanks for making the requested changes on this @feliperezende-barbosa - LGTM!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.