Support for azurerm_storage_account sas_policy.expiration_action set to "Block"

[scratch85]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Configuring

  sas_policy {
    expiration_period = "00.01:00:00"
    expiration_action = "Block"
  }

leads to error:

Error: expected sas_policy.0.expiration_action to be one of ["Log"], got Block

Terraform docs say:

[expiration_action](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account#expiration_action-4) - (Optional) The SAS expiration action. The only possible value is Log at this moment. Defaults to Log.

But actually "Block" is a valid value according to Azure Storage Account API:

The SAS Expiration Action defines the action to be performed when sasPolicy.sasExpirationPeriod is violated. The 'Log' action can be used for audit purposes and the 'Block' action can be used to block and deny the usage of SAS tokens that do not adhere to the sas policy expiration period.

New or Affected Resource(s)/Data Source(s)

azurerm_storage_account

Potential Terraform Configuration

sas_policy {
  expiration_period = "00.01:00:00"
  expiration_action = "Block"
}

References

• https://learn.microsoft.com/en-us/rest/api/storagerp/storage-accounts/create?view=rest-storagerp-2023-05-01&tabs=HTTP#saspolicy
• https://learn.microsoft.com/en-us/azure/templates/microsoft.storage/storageaccounts?pivots=deployment-language-arm-template#saspolicy-1

[magodo]

This new enum value is introduced in API version 2023-05-01 (even 2023-04-01 doesn't have that), so the issue is depending on #27760.