Support for Azure Redis Cache to use AD Authentication

[jonathan-fileread]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Azure Redis now allows AD authentication to use identity based authentication (e.g. through defaultazurecredential) to make a connection string to redis.

Currently this exists in bicep, but not in terraform. We'd love to get a boolean toggle to enable this authentication method! See screenshot below. under Redis > Advanced Settings

New or Affected Resource(s)/Data Source(s)

azurerm_redis_cache

Potential Terraform Configuration

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

# NOTE: the Name used for Redis needs to be globally unique
resource "azurerm_redis_cache" "example" {
  name                = "example-cache"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  capacity            = 2
  family              = "C"
  **entra_authentication = true** <-- this one!
  sku_name            = "Standard"
  enable_non_ssl_port = false
  minimum_tls_version = "1.2"

  redis_configuration {
  }
}

References

https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication

[tombuildsstuff]

Support for this is available in hashicorp/go-azure-sdk in API version 2023-08-01 - however it appears this needs to be updated to use the new API Version to enable this, so I'm tagging this as such.

[Waylonwhynot]

When does the Terraform-provider-azurerm support this feature?

[favoretti]

@Waylonwhynot in a bit, PR is being tested as we speak.

[dhensby]

duplicate of #15068?

[favoretti]

duplicate of #15068?

Is it? Not sure to be honest. #15066 looks more like accessing underlying storage accounts using an either user-assigned or system-assigned managed identity, where as this is authentication towards redis instance itself?

https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication

[dhensby]

Ah - ok - I thought they were related, but if they are distinct then that's fair enough

[jonathan-fileread]

thanks @favoretti @manicminer for pushing this one out. While toggle for enabling AAD is now enabled, we're still missing functionality to add a redis_user, or access_policies via terraform. Should I create another ticket for this?

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.