azurerm_postgresql_flexible_server - mark public_network_access_enabled as optional

internal/services/postgres/postgresql_flexible_server_resource.go

@@ -278,6 +278,7 @@ func resourcePostgresqlFlexibleServer() *pluginsdk.Resource {
 
 			"public_network_access_enabled": {
 				Type:     pluginsdk.TypeBool,
+				Optional: true,
 				Computed: true,
 			},
 
@@ -767,7 +768,7 @@ func resourcePostgresqlFlexibleServerUpdate(d *pluginsdk.ResourceData, meta inte
 		}
 	}
 
-	if d.HasChange("private_dns_zone_id") {
+	if d.HasChange("private_dns_zone_id") || d.HasChange("public_network_access_enabled") {
 		parameters.Properties.Network = expandArmServerNetwork(d)
 	}
 
@@ -964,6 +965,15 @@ func expandArmServerNetwork(d *pluginsdk.ResourceData) *servers.Network {
 		network.PrivateDnsZoneArmResourceId = utils.String(v.(string))
 	}
 
+	// `d.GetOk()` cannot identify if the bool property `public_network_access_enabled` is set or not in the tf config since d.GetOk() always returns `false` when `public_network_access_enabled` is set to `false` and `public_network_access_enabled` isn't set in the tf config
+	if !pluginsdk.IsExplicitlyNullInConfig(d, "public_network_access_enabled") {
+		publicNetworkAccessEnabled := servers.ServerPublicNetworkAccessStateDisabled
+		if d.Get("public_network_access_enabled").(bool) {
+			publicNetworkAccessEnabled = servers.ServerPublicNetworkAccessStateEnabled
+		}
+		network.PublicNetworkAccess = pointer.To(publicNetworkAccessEnabled)
+	}
+
 	return &network
 }
 

internal/services/postgres/postgresql_flexible_server_resource_test.go

@@ -524,6 +524,27 @@ func TestAccPostgresqlFlexibleServer_invalidStorageTierScalingStorageMbStorageTi
 	})
 }
 
+func TestAccPostgresqlFlexibleServer_publicNetworkAccessEnabled(t *testing.T) {
+	data := acceptance.BuildTestData(t, "azurerm_postgresql_flexible_server", "test")
+	r := PostgresqlFlexibleServerResource{}
+	data.ResourceTest(t, r, []acceptance.TestStep{
+		{
+			Config: r.publicNetworkAccessEnabled(data, true),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep("administrator_password", "create_mode"),
+		{
+			Config: r.publicNetworkAccessEnabled(data, false),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).ExistsInAzure(r),
+			),
+		},
+		data.ImportStep("administrator_password", "create_mode"),
+	})
+}
+
 func (PostgresqlFlexibleServerResource) Exists(ctx context.Context, clients *clients.Client, state *pluginsdk.InstanceState) (*bool, error) {
 	id, err := servers.ParseFlexibleServerID(state.ID)
 	if err != nil {
@@ -1267,3 +1288,21 @@ resource "azurerm_postgresql_flexible_server" "test" {
 }
 `, r.template(data), data.RandomInteger, storageMb, storageTier)
 }
+
+func (r PostgresqlFlexibleServerResource) publicNetworkAccessEnabled(data acceptance.TestData, publicNetworkAccessEnabled bool) string {
+	return fmt.Sprintf(`
+%s
+
+resource "azurerm_postgresql_flexible_server" "test" {
+  name                          = "acctest-fs-%d"
+  resource_group_name           = azurerm_resource_group.test.name
+  location                      = azurerm_resource_group.test.location
+  administrator_login           = "adminTerraform"
+  administrator_password        = "QAZwsx123"
+  version                       = "12"
+  sku_name                      = "GP_Standard_D2s_v3"
+  zone                          = "2"
+  public_network_access_enabled = %t
+}
+`, r.template(data), data.RandomInteger, publicNetworkAccessEnabled)
+}

website/docs/r/postgresql_flexible_server.html.markdown

@@ -116,6 +116,12 @@ The following arguments are supported:
 
 ~> **Note:** There will be a breaking change from upstream service at 15th July 2021, the `private_dns_zone_id` will be required when setting a `delegated_subnet_id`. For existing flexible servers who don't want to be recreated, you need to provide the `private_dns_zone_id` to the service team to manually migrate to the specified private DNS zone. The `azurerm_private_dns_zone` should end with suffix `.postgres.database.azure.com`.
 
+* `public_network_access_enabled` - (Optional) Is public network access enabled?
+
+~> **Note:** When `delegated_subnet_id` and `private_dns_zone_id` are set, the default value of `public_network_access_enabled` is `false`.
+
+~> **Note:** When `delegated_subnet_id` and `private_dns_zone_id` aren't set, the default value of `public_network_access_enabled` is `true`.
+
 * `high_availability` - (Optional) A `high_availability` block as defined below.
 
 * `identity` - (Optional) An `identity` block as defined below.
@@ -245,8 +251,6 @@ In addition to the Arguments listed above - the following Attributes are exporte
 
 * `fqdn` - The FQDN of the PostgreSQL Flexible Server.
 
-* `public_network_access_enabled` - Is public network access enabled?
-
 ## Timeouts
 
 The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions: