Support for Resource Instances in the Firewall for Storage Accounts

[kevinmatthews-kpmg]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

There is an option for resource instances in the firewall for storage accounts, this allows you to choose a resource type and resource instance that should be allowed through the firewall. An example of this might be to allow an azure synapse workspace to connect to the storage account

New or Affected Resource(s)

• azurerm_storage_account
• azurerm_storage_account_network_rules

Potential Terraform Configuration

resource "azurerm_storage_account" "example" {
  name                             = "storageaccountname"
  resource_group_name       = azurerm_resource_group.example.name

  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  network_rules {
    default_action             = "Deny"
    ip_rules                   = ["100.0.0.1"]
    virtual_network_subnet_ids = [azurerm_subnet.example.id]

    resource_instance {
      resource_type = "Microsoft.Synapse/workspaces"
      instance_name = "<resource name>"
      or
      resource_id = azurerm_synapse_workspace.example.id
    }
  }
}

References

• 0000

[aslatter]

This feature is now GA: https://azure.microsoft.com/en-us/updates/storage-resource-instance-rules-ga/

It appears that the REST APIs for creating Storage Accounts support this feature: https://docs.microsoft.com/en-us/rest/api/storagerp/storage-accounts/create?tabs=HTTP#networkruleset

[jeraldkphilip-ust]

is there a workaround to add resource instances via terraform?

[aslatter]

It's supported today - it's just called private_link_access:

A private_link_access block supports the following:

• endpoint_resource_id - (Required) The ID of the Azure resource that should be allowed access to the target storage account.

• endpoint_tenant_id - (Optional) The tenant id of the resource of the resource access rule to be granted access. Defaults to the current tenant id.