feat: support storage accounts without shared key in the table connector and function_app_linux AB#6472

modules/azure/api_connectors/storage_table_managed_identity/connection.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "location": {
+      "type": "String",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "description": "location"
+      }
+    },
+    "connection_name": {
+      "type": "String",
+      "metadata": {
+        "description": "Name to give to the connection"
+      }
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Web/connections",
+      "apiVersion": "2018-07-01-preview",
+      "name": "[parameters('connection_name')]",
+      "location": "[parameters('location')]",
+      "kind": "V1",
+      "properties": {
+        "displayName": "Storage Table Connection",
+        "api": {
+          "name": "azuretables",
+          "id": "[format('{0}/providers/Microsoft.Web/locations/{1}/managedApis/azuretables', subscription().id, parameters('location'))]"
+        },
+        "alternativeParameterValues": {},
+        "parameterValueSet": {
+          "name": "managedIdentityAuth"
+        }
+      }
+    }
+  ]
+}

modules/azure/api_connectors/storage_table_managed_identity/main.tf

@@ -0,0 +1,29 @@
+terraform {
+  required_version = "~> 1.12"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.117"
+    }
+  }
+
+  backend "azurerm" {}
+}
+
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group_template_deployment" "storage_account" {
+  name                = "${var.connection_name}_deployment"
+  resource_group_name = var.resource_group_name
+
+  template_content = file("./connection.json")
+  parameters_content = jsonencode({
+    "connection_name" = {
+      value = var.connection_name
+    }
+  })
+  deployment_mode = "Incremental"
+}

modules/azure/api_connectors/storage_table_managed_identity/outputs.tf

@@ -0,0 +1,3 @@
+output "name" {
+  value = var.connection_name
+}

modules/azure/api_connectors/storage_table_managed_identity/variables.tf

@@ -0,0 +1,9 @@
+variable "resource_group_name" {
+  type        = string
+  description = "Resource group the connection should be placed in"
+}
+
+variable "connection_name" {
+  type        = string
+  description = "Name of the connection"
+}

modules/azure/function_app_linux/main.tf

@@ -18,13 +18,14 @@ provider "azurerm" {
 # Function App
 
 resource "azurerm_linux_function_app" "function_app" {
-  name                        = var.name
-  location                    = var.location
-  resource_group_name         = var.resource_group_name
-  service_plan_id             = var.service_plan_id
-  storage_account_name        = var.storage_account_name
-  storage_account_access_key  = var.storage_account_access_key
-  functions_extension_version = var.runtime_version
+  name                          = var.name
+  location                      = var.location
+  resource_group_name           = var.resource_group_name
+  service_plan_id               = var.service_plan_id
+  storage_account_name          = var.storage_account_name
+  storage_account_access_key    = var.use_managed_identity ? null : var.storage_account_access_key
+  storage_uses_managed_identity = var.use_managed_identity ? true : null
+  functions_extension_version   = var.runtime_version
 
   app_settings = var.app_settings
 

modules/azure/function_app_linux/variables.tf

@@ -43,7 +43,14 @@ variable "storage_account_name" {
 
 variable "storage_account_access_key" {
   type        = string
-  description = " The access key which will be used to access the backend storage account for the Function App."
+  description = "The access key which will be used to access the backend storage account for the Function App. Leave empty when use_managed_identity is true."
+  default     = null
+}
+
+variable "use_managed_identity" {
+  type        = bool
+  description = "Connect to the backend storage account with the system assigned identity instead of the access key, so the account can run without shared key access."
+  default     = false
 }
 
 variable "app_settings" {