Terraform-provider-azurerm: `allow_blob_public_access` is not reflecting while upgrading provider version 1.44 to 2.23

[jibinpb]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.12.28
+ provider.azurerm v2.23.0

Affected Resource(s)

• azurerm_storage_account

Terraform Configuration Files

resource "azurerm_storage_account" "example" {
  name                     = "teststoragexxx"
  resource_group_name      = data.azurerm_resource_group.example.name
  location                 = data.azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  enable_https_traffic_only = true
  ## ADDED
  allow_blob_public_access  = false

  network_rules {
    default_action = "Deny"
    bypass         = ["AzureServices"]
  }
}

Debug Output

Nothing.

Panic Output

Nothing.

Expected Behavior

The property allow_blob_public_access should disable the configuration property Allow Blob public access of storage account

Actual Behavior

Provision a storage account using AzureRm provider version 1.44 and property allow_blob_public_access is not available in that version. Then change the provider version to above 2.20 and set false for allow_blob_public_access explicitly.

The plan generated with allow_blob_public_access as false and no change, even though the portal shows Enabled.

This is the generated plan for updating Storage with new provider on Step Number 4

After the applying the plan Step Number 5 it did not made any change to configuration property Allow Blob public access, but Account Kind is changed as per the plan.

Steps to Reproduce

1. Create storage account using AzureRm provider version 1.44

   terraform {
       required_version = ">= 0.11"
       required_providers {
           azurerm = "~> 1.44"
       }
   }
   
   provider "azurerm" {
   features {}
   }
   
   data "azurerm_resource_group" "example" {
   name     = "test-rg"
   }
   
   resource "azurerm_storage_account" "example" {
   name                     = "teststoragexxx"
   resource_group_name      = data.azurerm_resource_group.example.name
   location                 = data.azurerm_resource_group.example.location
   account_tier             = "Standard"
   account_replication_type = "LRS"
   
   enable_https_traffic_only = true
   
   network_rules {
       default_action = "Deny"
       bypass         = ["AzureServices"]
   }
   }
   

2. terraform apply

3. Change AzureRm provider version to ~> 2.20 and set false for allow_blob_public_access.

   terraform {
       required_version = ">= 0.11"
       required_providers {
           azurerm = "~> 2.20"
       }
   }
   
   provider "azurerm" {
   features {}
   }
   
   data "azurerm_resource_group" "example" {
   name     = "test-rg"
   }
   
   resource "azurerm_storage_account" "example" {
   name                     = "teststoragexxx"
   resource_group_name      = data.azurerm_resource_group.example.name
   location                 = data.azurerm_resource_group.example.location
   account_tier             = "Standard"
   account_replication_type = "LRS"
   
   enable_https_traffic_only = true
   ## ADDED
   allow_blob_public_access  = false
   
   network_rules {
       default_action = "Deny"
       bypass         = ["AzureServices"]
   }
   }
   

4. terraform plan
5. terraform apply

Important Factoids

Nothing.

References

• allow_blob_public_access

[neil-yechenwei]

Thanks for opening this issue. After investigated, seems api returns nil while not specifying the value of allow_blob_public_access. So terraform should return the default status. So I submit a PR to fix the issue.

[jibinpb]

Thank you so much @neil-yechenwei , will use PowerShell as interim fix

[smitp11]

Having the exact same issue on:
Terraform v0.12.24

• provider.azurerm v2.23.0

@jibinpb - could you share a PowerShell example of your interim fix?

[jibinpb]

Here is the script, applied manually.

# Install-Module -Name Az.ResourceGraph
# Install-Module -Name Az.Storage

$Subscription = "YOUR-SUBSCRIPTION-ID"
$StorageAccounts = Search-AzGraph -Query "
Resources 
    | where type =~ 'Microsoft.Storage/storageAccounts' 
        and isempty(properties.allowBlobPublicAccess)" -Subscription $Subscription
foreach ($StorageAccount in $StorageAccounts) {
    Write-Host "$($StorageAccount.resourceGroup) / $($StorageAccount.name)"    
    Set-AzStorageAccount  -ResourceGroupName $StorageAccount.resourceGroup -AccountName $StorageAccount.name -AllowBlobPublicAccess $false
}