From 777926ace502af9d61ef1b55edc550c64c04a542 Mon Sep 17 00:00:00 2001 From: Kelly Faessen Date: Tue, 22 Sep 2026 12:42:34 +0200 Subject: [PATCH 1/3] feat: add a storage table api connector that authenticates with managed identity AB#6472 --- .../connection.json | 39 +++++++++++++++++++ .../storage_table_managed_identity/main.tf | 29 ++++++++++++++ .../storage_table_managed_identity/outputs.tf | 3 ++ .../variables.tf | 9 +++++ 4 files changed, 80 insertions(+) create mode 100644 modules/azure/api_connectors/storage_table_managed_identity/connection.json create mode 100644 modules/azure/api_connectors/storage_table_managed_identity/main.tf create mode 100644 modules/azure/api_connectors/storage_table_managed_identity/outputs.tf create mode 100644 modules/azure/api_connectors/storage_table_managed_identity/variables.tf diff --git a/modules/azure/api_connectors/storage_table_managed_identity/connection.json b/modules/azure/api_connectors/storage_table_managed_identity/connection.json new file mode 100644 index 00000000..e4bd0b98 --- /dev/null +++ b/modules/azure/api_connectors/storage_table_managed_identity/connection.json @@ -0,0 +1,39 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "location": { + "type": "String", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "location" + } + }, + "connection_name": { + "type": "String", + "metadata": { + "description": "Name to give to the connection" + } + } + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2018-07-01-preview", + "name": "[parameters('connection_name')]", + "location": "[parameters('location')]", + "kind": "V1", + "properties": { + "displayName": "Storage Table Connection", + "api": { + "name": "azuretables", + "id": "[format('{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuretables', subscription().id, parameters('location'))]" + }, + "alternativeParameterValues": {}, + "parameterValueSet": { + "name": "managedIdentityAuth" + } + } + } + ] +} \ No newline at end of file diff --git a/modules/azure/api_connectors/storage_table_managed_identity/main.tf b/modules/azure/api_connectors/storage_table_managed_identity/main.tf new file mode 100644 index 00000000..99d64982 --- /dev/null +++ b/modules/azure/api_connectors/storage_table_managed_identity/main.tf @@ -0,0 +1,29 @@ +terraform { + required_version = "~> 1.12" + + required_providers { + azurerm = { + source = "hashicorp/azurerm" + version = "~> 3.117" + } + } + + backend "azurerm" {} +} + +provider "azurerm" { + features {} +} + +resource "azurerm_resource_group_template_deployment" "storage_table" { + name = "${var.connection_name}_deployment" + resource_group_name = var.resource_group_name + + template_content = file("./connection.json") + parameters_content = jsonencode({ + "connection_name" = { + value = var.connection_name + } + }) + deployment_mode = "Incremental" +} diff --git a/modules/azure/api_connectors/storage_table_managed_identity/outputs.tf b/modules/azure/api_connectors/storage_table_managed_identity/outputs.tf new file mode 100644 index 00000000..e1e4f872 --- /dev/null +++ b/modules/azure/api_connectors/storage_table_managed_identity/outputs.tf @@ -0,0 +1,3 @@ +output "name" { + value = var.connection_name +} \ No newline at end of file diff --git a/modules/azure/api_connectors/storage_table_managed_identity/variables.tf b/modules/azure/api_connectors/storage_table_managed_identity/variables.tf new file mode 100644 index 00000000..4151fcad --- /dev/null +++ b/modules/azure/api_connectors/storage_table_managed_identity/variables.tf @@ -0,0 +1,9 @@ +variable "resource_group_name" { + type = string + description = "Resource group the connection should be placed in" +} + +variable "connection_name" { + type = string + description = "Name of the connection" +} From 22900e400d48953dbe0c48b4b6a586267f406b88 Mon Sep 17 00:00:00 2001 From: Kelly Faessen Date: Tue, 22 Sep 2026 12:48:09 +0200 Subject: [PATCH 2/3] feat: let function_app_linux reach its storage with managed identity AB#6472 --- modules/azure/function_app_linux/main.tf | 15 ++++++++------- modules/azure/function_app_linux/variables.tf | 9 ++++++++- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/modules/azure/function_app_linux/main.tf b/modules/azure/function_app_linux/main.tf index 5b325e61..6b6a0a27 100644 --- a/modules/azure/function_app_linux/main.tf +++ b/modules/azure/function_app_linux/main.tf @@ -18,13 +18,14 @@ provider "azurerm" { # Function App resource "azurerm_linux_function_app" "function_app" { - name = var.name - location = var.location - resource_group_name = var.resource_group_name - service_plan_id = var.service_plan_id - storage_account_name = var.storage_account_name - storage_account_access_key = var.storage_account_access_key - functions_extension_version = var.runtime_version + name = var.name + location = var.location + resource_group_name = var.resource_group_name + service_plan_id = var.service_plan_id + storage_account_name = var.storage_account_name + storage_account_access_key = var.use_managed_identity ? null : var.storage_account_access_key + storage_uses_managed_identity = var.use_managed_identity ? true : null + functions_extension_version = var.runtime_version app_settings = var.app_settings diff --git a/modules/azure/function_app_linux/variables.tf b/modules/azure/function_app_linux/variables.tf index 3d14f9b4..749f22a1 100644 --- a/modules/azure/function_app_linux/variables.tf +++ b/modules/azure/function_app_linux/variables.tf @@ -43,7 +43,14 @@ variable "storage_account_name" { variable "storage_account_access_key" { type = string - description = " The access key which will be used to access the backend storage account for the Function App." + description = "The access key which will be used to access the backend storage account for the Function App. Leave empty when use_managed_identity is true." + default = null +} + +variable "use_managed_identity" { + type = bool + description = "Connect to the backend storage account with the system assigned identity instead of the access key, so the account can run without shared key access." + default = false } variable "app_settings" { From 621ea86f7102f288a2144d9a185b6ca640b10f13 Mon Sep 17 00:00:00 2001 From: Kelly Faessen Date: Wed, 14 Oct 2026 15:43:30 +0200 Subject: [PATCH 3/3] fix: keep the storage_table resource address in the managed identity connector AB#6472 Switching a unit from storage_table to storage_table_managed_identity now keeps the same resource address, so Terraform updates the existing connection deployment in place instead of destroying and recreating it. --- .../azure/api_connectors/storage_table_managed_identity/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/azure/api_connectors/storage_table_managed_identity/main.tf b/modules/azure/api_connectors/storage_table_managed_identity/main.tf index 99d64982..7618062b 100644 --- a/modules/azure/api_connectors/storage_table_managed_identity/main.tf +++ b/modules/azure/api_connectors/storage_table_managed_identity/main.tf @@ -15,7 +15,7 @@ provider "azurerm" { features {} } -resource "azurerm_resource_group_template_deployment" "storage_table" { +resource "azurerm_resource_group_template_deployment" "storage_account" { name = "${var.connection_name}_deployment" resource_group_name = var.resource_group_name