Sql server auditing policies fail to be set with storage account with firewall or vn

[yupwei68]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Affected Resource(s)

azurerm_sql_server
azurerm_sql_active_directory_administrator

Terraform Configuration Files

resource "azurerm_sql_server" "server" {
  name                         = var.primary_sql_server_name == null ? local.primary_sql_server_name : lower(var.primary_sql_server_name)
  resource_group_name          = var.resource_group_name
  location                     = var.location
  version                      = var.server_version
  administrator_login          = "azureadmin"
  administrator_login_password = random_password.password.result

  extended_auditing_policy {
    storage_endpoint                        = var.primary_server_storage_endpoint
    storage_account_access_key              = var.primary_server_storage_account_access_key
    storage_account_access_key_is_secondary = var.storage_account_access_key_is_secondary
    retention_in_days                       = var.retention_in_days
  }
  tags = var.tags

}

resource "azurerm_sql_active_directory_administrator" "aad_admin" {
  server_name         = azurerm_sql_server.server.name
  resource_group_name = var.resource_group_name
  login               = var.sql_active_directory_admin_name
  tenant_id           = data.azurerm_client_config.current.tenant_id
  object_id           = var.object_id
}

Expected Behavior

Sql server bind a storage account with firewall or vn

Actual Behavior

Sql server doesn't bind this storage account with firewall or vn in auditing

Steps to Reproduce

1. create a storage account with firewall or virtual network
2. terraform apply with success
3. The portal shows that the storage account doesn't be bound in auditing

[katbyte]

potentially related to #2977

[yupwei68]

Hi @katbyte No, it requires sql server admin permission to bind a storage account with firewall or vn. I plan to create a new resource mssql_server with set_admin as an internal block to solve this.

[katbyte]

@yupwei68 - i've created a mssql resoruce here #6677 - but i don't see any property on the server resource, is it set by another client?

[yupwei68]

@katbyte , yes. I shall create it based on #6677

[ghost]

This has been released in version 2.10.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.10.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!