Skip to content

Commit 5e0f71a

Browse files
tombuildsstufftombuildsstuff
authored
Merge pull request #8304 from terraform-providers/f/key-vault-external-updates
r/key_vault_(key|secret): updating the latest version when updating metadata
2 parents ad92423 + e172196 commit 5e0f71a

File tree

4 files changed

+292
-15
lines changed

4 files changed

+292
-15
lines changed

‎azurerm/internal/services/keyvault/key_vault_key_resource.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ func resourceArmKeyVaultKeyUpdate(d *schema.ResourceData, meta interface{}) erro
310310
parameters.KeyAttributes.Expires = &expirationUnixTime
311311
}
312312

313-
if _, err = client.UpdateKey(ctx, id.KeyVaultBaseUrl, id.Name, id.Version, parameters); err != nil {
313+
if _, err = client.UpdateKey(ctx, id.KeyVaultBaseUrl, id.Name, "", parameters); err != nil {
314314
return err
315315
}
316316

‎azurerm/internal/services/keyvault/key_vault_secret_resource.go

+14-14
Original file line numberDiff line numberDiff line change
@@ -241,31 +241,31 @@ func resourceArmKeyVaultSecretUpdate(d *schema.ResourceData, meta interface{}) e
241241
if _, err = client.SetSecret(ctx, id.KeyVaultBaseUrl, id.Name, parameters); err != nil {
242242
return err
243243
}
244-
245-
// "" indicates the latest version
246-
read, err2 := client.GetSecret(ctx, id.KeyVaultBaseUrl, id.Name, "")
247-
if err2 != nil {
248-
return fmt.Errorf("Error getting Key Vault Secret %q : %+v", id.Name, err2)
249-
}
250-
251-
if _, err = azure.ParseKeyVaultChildID(*read.ID); err != nil {
252-
return err
253-
}
254-
255-
// the ID is suffixed with the secret version
256-
d.SetId(*read.ID)
257244
} else {
258245
parameters := keyvault.SecretUpdateParameters{
259246
ContentType: utils.String(contentType),
260247
Tags: tags.Expand(t),
261248
SecretAttributes: secretAttributes,
262249
}
263250

264-
if _, err = client.UpdateSecret(ctx, id.KeyVaultBaseUrl, id.Name, id.Version, parameters); err != nil {
251+
if _, err = client.UpdateSecret(ctx, id.KeyVaultBaseUrl, id.Name, "", parameters); err != nil {
265252
return err
266253
}
267254
}
268255

256+
// "" indicates the latest version
257+
read, err2 := client.GetSecret(ctx, id.KeyVaultBaseUrl, id.Name, "")
258+
if err2 != nil {
259+
return fmt.Errorf("Error getting Key Vault Secret %q : %+v", id.Name, err2)
260+
}
261+
262+
if _, err = azure.ParseKeyVaultChildID(*read.ID); err != nil {
263+
return err
264+
}
265+
266+
// the ID is suffixed with the secret version
267+
d.SetId(*read.ID)
268+
269269
return resourceArmKeyVaultSecretRead(d, meta)
270270
}
271271

‎azurerm/internal/services/keyvault/tests/key_vault_key_resource_test.go

+153
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,10 @@ import (
44
"fmt"
55
"log"
66
"testing"
7+
"time"
78

9+
"github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01/keyvault"
10+
"github.com/Azure/go-autorest/autorest/date"
811
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
912
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance"
1013
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients"
@@ -218,6 +221,37 @@ func TestAccAzureRMKeyVaultKey_update(t *testing.T) {
218221
})
219222
}
220223

224+
func TestAccAzureRMKeyVaultKey_updatedExternally(t *testing.T) {
225+
data := acceptance.BuildTestData(t, "azurerm_key_vault_key", "test")
226+
227+
resource.ParallelTest(t, resource.TestCase{
228+
PreCheck: func() { acceptance.PreCheck(t) },
229+
Providers: acceptance.SupportedProviders,
230+
CheckDestroy: testCheckAzureRMKeyVaultKeyDestroy,
231+
Steps: []resource.TestStep{
232+
{
233+
Config: testAccAzureRMKeyVaultKey_basicEC(data),
234+
Check: resource.ComposeTestCheckFunc(
235+
testCheckAzureRMKeyVaultKeyExists(data.ResourceName),
236+
updateExpiryDateForKeyVaultKey(data.ResourceName, "2029-02-02T12:59:00Z"),
237+
),
238+
ExpectNonEmptyPlan: true,
239+
},
240+
{
241+
Config: testAccAzureRMKeyVaultKey_basicECUpdatedExternally(data),
242+
Check: resource.ComposeTestCheckFunc(
243+
testCheckAzureRMKeyVaultKeyExists(data.ResourceName),
244+
),
245+
},
246+
{
247+
Config: testAccAzureRMKeyVaultKey_basicECUpdatedExternally(data),
248+
PlanOnly: true,
249+
},
250+
data.ImportStep("key_size"),
251+
},
252+
})
253+
}
254+
221255
func TestAccAzureRMKeyVaultKey_disappears(t *testing.T) {
222256
data := acceptance.BuildTestData(t, "azurerm_key_vault_key", "test")
223257

@@ -340,6 +374,60 @@ func testCheckAzureRMKeyVaultKeyExists(resourceName string) resource.TestCheckFu
340374
}
341375
}
342376

377+
func updateExpiryDateForKeyVaultKey(resourceName string, expiryDate string) resource.TestCheckFunc {
378+
return func(s *terraform.State) error {
379+
client := acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.ManagementClient
380+
vaultClient := acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.VaultsClient
381+
ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
382+
383+
// Ensure we have enough information in state to look up in API
384+
rs, ok := s.RootModule().Resources[resourceName]
385+
if !ok {
386+
return fmt.Errorf("Not found: %s", resourceName)
387+
}
388+
name := rs.Primary.Attributes["name"]
389+
keyVaultId := rs.Primary.Attributes["key_vault_id"]
390+
vaultBaseUrl, err := azure.GetKeyVaultBaseUrlFromID(ctx, vaultClient, keyVaultId)
391+
if err != nil {
392+
return fmt.Errorf("Error looking up Secret %q vault url from id %q: %+v", name, keyVaultId, err)
393+
}
394+
395+
ok, err = azure.KeyVaultExists(ctx, acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.VaultsClient, keyVaultId)
396+
if err != nil {
397+
return fmt.Errorf("Error checking if key vault %q for Key %q in Vault at url %q exists: %v", keyVaultId, name, vaultBaseUrl, err)
398+
}
399+
if !ok {
400+
log.Printf("[DEBUG] Key %q Key Vault %q was not found in Key Vault at URI %q ", name, keyVaultId, vaultBaseUrl)
401+
return nil
402+
}
403+
404+
expirationDate, err := time.Parse(time.RFC3339, expiryDate)
405+
if err != nil {
406+
return err
407+
}
408+
expirationUnixTime := date.UnixTime(expirationDate)
409+
update := keyvault.KeyUpdateParameters{
410+
KeyAttributes: &keyvault.KeyAttributes{
411+
Expires: &expirationUnixTime,
412+
},
413+
}
414+
if _, err = client.UpdateKey(ctx, vaultBaseUrl, name, "", update); err != nil {
415+
return fmt.Errorf("updating secret: %+v", err)
416+
}
417+
418+
resp, err := client.GetKey(ctx, vaultBaseUrl, name, "")
419+
if err != nil {
420+
if utils.ResponseWasNotFound(resp.Response) {
421+
return fmt.Errorf("Bad: Key Vault Key %q (resource group: %q) does not exist", name, vaultBaseUrl)
422+
}
423+
424+
return fmt.Errorf("Bad: Get on keyVaultManagementClient: %+v", err)
425+
}
426+
427+
return nil
428+
}
429+
}
430+
343431
func testCheckAzureRMKeyVaultKeyDisappears(resourceName string) resource.TestCheckFunc {
344432
return func(s *terraform.State) error {
345433
client := acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.ManagementClient
@@ -411,6 +499,7 @@ resource "azurerm_key_vault" "test" {
411499
"create",
412500
"delete",
413501
"get",
502+
"update",
414503
]
415504
416505
secret_permissions = [
@@ -439,6 +528,70 @@ resource "azurerm_key_vault_key" "test" {
439528
`, data.RandomInteger, data.Locations.Primary, data.RandomString, data.RandomString)
440529
}
441530

531+
func testAccAzureRMKeyVaultKey_basicECUpdatedExternally(data acceptance.TestData) string {
532+
return fmt.Sprintf(`
533+
provider "azurerm" {
534+
features {}
535+
}
536+
537+
data "azurerm_client_config" "current" {
538+
}
539+
540+
resource "azurerm_resource_group" "test" {
541+
name = "acctestRG-%d"
542+
location = "%s"
543+
}
544+
545+
resource "azurerm_key_vault" "test" {
546+
name = "acctestkv-%s"
547+
location = azurerm_resource_group.test.location
548+
resource_group_name = azurerm_resource_group.test.name
549+
tenant_id = data.azurerm_client_config.current.tenant_id
550+
551+
sku_name = "premium"
552+
553+
access_policy {
554+
tenant_id = data.azurerm_client_config.current.tenant_id
555+
object_id = data.azurerm_client_config.current.object_id
556+
557+
key_permissions = [
558+
"create",
559+
"delete",
560+
"get",
561+
"update",
562+
]
563+
564+
secret_permissions = [
565+
"get",
566+
"delete",
567+
"set",
568+
]
569+
}
570+
571+
tags = {
572+
environment = "Production"
573+
}
574+
}
575+
576+
resource "azurerm_key_vault_key" "test" {
577+
name = "key-%s"
578+
key_vault_id = azurerm_key_vault.test.id
579+
key_type = "EC"
580+
key_size = 2048
581+
expiration_date = "2029-02-02T12:59:00Z"
582+
583+
key_opts = [
584+
"sign",
585+
"verify",
586+
]
587+
588+
tags = {
589+
Rick = "Morty"
590+
}
591+
}
592+
`, data.RandomInteger, data.Locations.Primary, data.RandomString, data.RandomString)
593+
}
594+
442595
func testAccAzureRMKeyVaultKey_requiresImport(data acceptance.TestData) string {
443596
template := testAccAzureRMKeyVaultKey_basicEC(data)
444597
return fmt.Sprintf(`

‎azurerm/internal/services/keyvault/tests/key_vault_secret_resource_test.go

+124
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"log"
66
"testing"
77

8+
"github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01/keyvault"
89
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/azure"
910
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance"
1011
"github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients"
@@ -146,6 +147,38 @@ func TestAccAzureRMKeyVaultSecret_update(t *testing.T) {
146147
})
147148
}
148149

150+
func TestAccAzureRMKeyVaultSecret_updatingValueChangedExternally(t *testing.T) {
151+
data := acceptance.BuildTestData(t, "azurerm_key_vault_secret", "test")
152+
153+
resource.ParallelTest(t, resource.TestCase{
154+
PreCheck: func() { acceptance.PreCheck(t) },
155+
Providers: acceptance.SupportedProviders,
156+
CheckDestroy: testCheckAzureRMKeyVaultSecretDestroy,
157+
Steps: []resource.TestStep{
158+
{
159+
Config: testAccAzureRMKeyVaultSecret_basic(data),
160+
Check: resource.ComposeTestCheckFunc(
161+
testCheckAzureRMKeyVaultSecretExists(data.ResourceName),
162+
resource.TestCheckResourceAttr(data.ResourceName, "value", "rick-and-morty"),
163+
updateKeyVaultSecretValue(data.ResourceName, "mad-scientist"),
164+
),
165+
ExpectNonEmptyPlan: true,
166+
},
167+
{
168+
Config: testAccAzureRMKeyVaultSecret_updateTags(data),
169+
Check: resource.ComposeTestCheckFunc(
170+
testCheckAzureRMKeyVaultSecretExists(data.ResourceName),
171+
),
172+
},
173+
{
174+
Config: testAccAzureRMKeyVaultSecret_updateTags(data),
175+
PlanOnly: true,
176+
},
177+
data.ImportStep(),
178+
},
179+
})
180+
}
181+
149182
func TestAccAzureRMKeyVaultSecret_recovery(t *testing.T) {
150183
data := acceptance.BuildTestData(t, "azurerm_key_vault_secret", "test")
151184

@@ -299,6 +332,43 @@ func testCheckAzureRMKeyVaultSecretDisappears(resourceName string) resource.Test
299332
}
300333
}
301334

335+
func updateKeyVaultSecretValue(resourceName, value string) resource.TestCheckFunc {
336+
return func(s *terraform.State) error {
337+
client := acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.ManagementClient
338+
vaultClient := acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.VaultsClient
339+
ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
340+
341+
// Ensure we have enough information in state to look up in API
342+
rs, ok := s.RootModule().Resources[resourceName]
343+
if !ok {
344+
return fmt.Errorf("Not found: %s", resourceName)
345+
}
346+
name := rs.Primary.Attributes["name"]
347+
keyVaultId := rs.Primary.Attributes["key_vault_id"]
348+
vaultBaseUrl, err := azure.GetKeyVaultBaseUrlFromID(ctx, vaultClient, keyVaultId)
349+
if err != nil {
350+
return fmt.Errorf("Error looking up Secret %q vault url from id %q: %+v", name, keyVaultId, err)
351+
}
352+
353+
ok, err = azure.KeyVaultExists(ctx, acceptance.AzureProvider.Meta().(*clients.Client).KeyVault.VaultsClient, keyVaultId)
354+
if err != nil {
355+
return fmt.Errorf("Error checking if key vault %q for Secret %q in Vault at url %q exists: %v", keyVaultId, name, vaultBaseUrl, err)
356+
}
357+
if !ok {
358+
log.Printf("[DEBUG] Secret %q Key Vault %q was not found in Key Vault at URI %q ", name, keyVaultId, vaultBaseUrl)
359+
return nil
360+
}
361+
362+
updated := keyvault.SecretSetParameters{
363+
Value: utils.String(value),
364+
}
365+
if _, err = client.SetSecret(ctx, vaultBaseUrl, name, updated); err != nil {
366+
return fmt.Errorf("updating secret: %+v", err)
367+
}
368+
return nil
369+
}
370+
}
371+
302372
func testAccAzureRMKeyVaultSecret_basic(data acceptance.TestData) string {
303373
return fmt.Sprintf(`
304374
provider "azurerm" {
@@ -349,6 +419,60 @@ resource "azurerm_key_vault_secret" "test" {
349419
`, data.RandomInteger, data.Locations.Primary, data.RandomString, data.RandomString)
350420
}
351421

422+
func testAccAzureRMKeyVaultSecret_updateTags(data acceptance.TestData) string {
423+
return fmt.Sprintf(`
424+
provider "azurerm" {
425+
features {}
426+
}
427+
428+
data "azurerm_client_config" "current" {
429+
}
430+
431+
resource "azurerm_resource_group" "test" {
432+
name = "acctestRG-%d"
433+
location = "%s"
434+
}
435+
436+
resource "azurerm_key_vault" "test" {
437+
name = "acctestkv-%s"
438+
location = azurerm_resource_group.test.location
439+
resource_group_name = azurerm_resource_group.test.name
440+
tenant_id = data.azurerm_client_config.current.tenant_id
441+
442+
sku_name = "premium"
443+
444+
access_policy {
445+
tenant_id = data.azurerm_client_config.current.tenant_id
446+
object_id = data.azurerm_client_config.current.object_id
447+
448+
key_permissions = [
449+
"get",
450+
]
451+
452+
secret_permissions = [
453+
"get",
454+
"delete",
455+
"set",
456+
]
457+
}
458+
459+
tags = {
460+
environment = "Production"
461+
}
462+
}
463+
464+
resource "azurerm_key_vault_secret" "test" {
465+
name = "secret-%s"
466+
value = "mad-scientist"
467+
key_vault_id = azurerm_key_vault.test.id
468+
469+
tags = {
470+
Rick = "Morty"
471+
}
472+
}
473+
`, data.RandomInteger, data.Locations.Primary, data.RandomString, data.RandomString)
474+
}
475+
352476
func testAccAzureRMKeyVaultSecret_requiresImport(data acceptance.TestData) string {
353477
template := testAccAzureRMKeyVaultSecret_basic(data)
354478
return fmt.Sprintf(`

0 commit comments

Comments
 (0)