Skip to content

Commit

Permalink
Test versioned and version-less URI to certificate in Key Vault
Browse files Browse the repository at this point in the history 
Signed-off-by: Sune Keller <absukl@almbrand.dk>
  • Loading branch information
@sirlatrom
sirlatrom committed May 13, 2020
1 parent 703976a commit e4f5b70
Showing 1 changed file with 273 additions and 5 deletions.
278 changes: 273 additions & 5 deletions azurerm/internal/services/apimanagement/tests/api_management_resource_test.go
View file
Expand Up @@ -191,6 +191,58 @@ func TestAccAzureRMApiManagement_virtualNetworkInternal(t *testing.T) {
})
}

func TestAccAzureRMApiManagement_identitySystemAssignedUpdateHostnameConfigurationsVersionedKeyVaultId(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_api_management", "test")

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { acceptance.PreCheck(t) },
Providers: acceptance.SupportedProviders,
CheckDestroy: testCheckAzureRMApiManagementDestroy,
Steps: []resource.TestStep{
{
Config: testAccAzureRMApiManagement_identitySystemAssigned(data),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMApiManagementExists(data.ResourceName),
),
},
data.ImportStep(),
{
Config: testAccAzureRMApiManagement_identitySystemAssignedUpdateHostnameConfigurationsVersionedKeyVaultId(data),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMApiManagementExists(data.ResourceName),
),
},
data.ImportStep(),
},
})
}

func TestAccAzureRMApiManagement_identitySystemAssignedUpdateHostnameConfigurationsVersionlessKeyVaultId(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_api_management", "test")

resource.ParallelTest(t, resource.TestCase{
PreCheck: func() { acceptance.PreCheck(t) },
Providers: acceptance.SupportedProviders,
CheckDestroy: testCheckAzureRMApiManagementDestroy,
Steps: []resource.TestStep{
{
Config: testAccAzureRMApiManagement_identitySystemAssigned(data),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMApiManagementExists(data.ResourceName),
),
},
data.ImportStep(),
{
Config: testAccAzureRMApiManagement_identitySystemAssignedUpdateHostnameConfigurationsVersionlessKeyVaultId(data),
Check: resource.ComposeTestCheckFunc(
testCheckAzureRMApiManagementExists(data.ResourceName),
),
},
data.ImportStep(),
},
})
}

func testCheckAzureRMApiManagementDestroy(s *terraform.State) error {
conn := acceptance.AzureProvider.Meta().(*clients.Client).ApiManagement.ServiceClient
ctx := acceptance.AzureProvider.Meta().(*clients.Client).StopContext
Expand Down Expand Up @@ -889,21 +941,17 @@ func testAccAzureRMApiManagement_identitySystemAssigned(data acceptance.TestData
provider "azurerm" {
features {}
}
resource "azurerm_resource_group" "test" {
name = "acctestRG-%d"
location = "%s"
}
resource "azurerm_api_management" "test" {
name = "acctestAM-%d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
publisher_name = "pub1"
publisher_email = "pub1@email.com"
sku_name = "Developer_1"
sku_name = "Developer_1"
identity {
type = "SystemAssigned"
}
Expand Down Expand Up @@ -973,3 +1021,223 @@ resource "azurerm_api_management" "test" {
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
}

func testAccAzureRMApiManagement_identitySystemAssignedUpdateHostnameConfigurationsVersionlessKeyVaultId(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}
resource "azurerm_resource_group" "test" {
name = "acctestRG-%[1]d"
location = "%[2]s"
}
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "test" {
name = "acctestKV-%[3]d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
tenant_id = data.azurerm_client_config.current.tenant_id
sku_name = "standard"
}
resource "azurerm_key_vault_access_policy" "test" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
certificate_permissions = [
"Create",
"Delete",
"Deleteissuers",
"Get",
"Getissuers",
"Import",
"List",
"Listissuers",
"Managecontacts",
"Manageissuers",
"Setissuers",
"Update",
]
secret_permissions = [
"Delete",
"Get",
"List",
"Purge",
]
}
resource "azurerm_key_vault_access_policy" "test2" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = azurerm_api_management.test.identity[0].tenant_id
object_id = azurerm_api_management.test.identity[0].principal_id
secret_permissions = [
"Get",
"List",
]
}
resource "azurerm_key_vault_certificate" "test" {
depends_on = [azurerm_key_vault_access_policy.test]
name = "acctestKVCert-%[3]d"
key_vault_id = azurerm_key_vault.test.id
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["api.terraform.io"]
}
subject = "CN=api.terraform.io"
validity_in_months = 1
}
}
}
resource "azurerm_api_management" "test" {
name = "acctestAM-%[3]d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
publisher_name = "pub1"
publisher_email = "pub1@email.com"
sku_name = "Developer_1"
identity {
type = "SystemAssigned"
}
hostname_configuration {
proxy {
host_name = "api.terraform.io"
key_vault_id = "${azurerm_key_vault.test.vault_uri}secrets/${azurerm_key_vault_certificate.test.name}"
default_ssl_binding = true
negotiate_client_certificate = false
}
}
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
}

func testAccAzureRMApiManagement_identitySystemAssignedUpdateHostnameConfigurationsVersionedKeyVaultId(data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}
resource "azurerm_resource_group" "test" {
name = "acctestRG-%[1]d"
location = "%[2]s"
}
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "test" {
name = "acctestKV-%[3]d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
tenant_id = data.azurerm_client_config.current.tenant_id
sku_name = "standard"
}
resource "azurerm_key_vault_access_policy" "test" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
certificate_permissions = [
"Create",
"Delete",
"Deleteissuers",
"Get",
"Getissuers",
"Import",
"List",
"Listissuers",
"Managecontacts",
"Manageissuers",
"Setissuers",
"Update",
]
secret_permissions = [
"Delete",
"Get",
"List",
"Purge",
]
}
resource "azurerm_key_vault_access_policy" "test2" {
key_vault_id = azurerm_key_vault.test.id
tenant_id = azurerm_api_management.test.identity[0].tenant_id
object_id = azurerm_api_management.test.identity[0].principal_id
secret_permissions = [
"Get",
"List",
]
}
resource "azurerm_key_vault_certificate" "test" {
depends_on = [azurerm_key_vault_access_policy.test]
name = "acctestKVCert-%[3]d"
key_vault_id = azurerm_key_vault.test.id
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["api.terraform.io"]
}
subject = "CN=api.terraform.io"
validity_in_months = 1
}
}
}
resource "azurerm_api_management" "test" {
name = "acctestAM-%[3]d"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
publisher_name = "pub1"
publisher_email = "pub1@email.com"
sku_name = "Developer_1"
identity {
type = "SystemAssigned"
}
hostname_configuration {
proxy {
host_name = "api.terraform.io"
key_vault_id = azurerm_key_vault_certificate.test.secret_id
default_ssl_binding = true
negotiate_client_certificate = false
}
}
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger)
}

0 comments on commit e4f5b70

Please sign in to comment.