add resource "azurerm_cognitive_account_customer_managed_key"

[ms-henglu]

The tests are listed as the followings.

=== RUN   TestAccCognitiveAccountCustomerManagedKey_basic
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_basic
=== CONT  TestAccCognitiveAccountCustomerManagedKey_basic
--- PASS: TestAccCognitiveAccountCustomerManagedKey_basic (525.17s)
=== RUN   TestAccCognitiveAccountCustomerManagedKey_requiresImport
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_requiresImport
=== CONT  TestAccCognitiveAccountCustomerManagedKey_requiresImport
--- PASS: TestAccCognitiveAccountCustomerManagedKey_requiresImport (612.83s)
=== RUN   TestAccCognitiveAccountCustomerManagedKey_complete
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_complete
=== CONT  TestAccCognitiveAccountCustomerManagedKey_complete
--- PASS: TestAccCognitiveAccountCustomerManagedKey_complete (597.85s)
=== RUN   TestAccCognitiveAccountCustomerManagedKey_update
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_update
=== CONT  TestAccCognitiveAccountCustomerManagedKey_update
--- PASS: TestAccCognitiveAccountCustomerManagedKey_update (748.21s)
PASS

[manicminer]

Hi @ms-henglu, thanks for this PR. I started reviewing but stopped when I got the the delete function - if I understand correctly, this is deleting the associated cognitive account resource and recreating it in order to achieve deletion of the CMK? If this is the case, we can't do that, and this resource would not be viable.

[manicminer]

This can be moved inside the following if block, no need to get the existing resource unless this is new

[ms-henglu]

Actually it can't. Because we need to update cmk of cognitive account, we need to make sure it exists.

[manicminer]

Potential crash here, needs nil checking

[ms-henglu]

I added nil-check above, so it won't be nil here.

[manicminer]

Same here

[ms-henglu]

I added nil-check above, so it won't be nil here.

[manicminer]

We can't just delete and recreate the associated Cognitive account?

With these limitations, this resource likely isn't viable. Perhaps it would be better as a block on the azurerm_cognitive_account resource?

[ms-henglu]

Hi @manicminer , we can't add it to azurerm_cognitive_account. Because we have a key access policy depends on azurerm_cognitive_account#identity, and a key vault key depends this policy, then cmk depends on the key vault key.
This means if we add it to azurerm_cognitive_account, it will cause circular dependency.

So it has to be a separate resource like other existing cmk resource.

refs: #12159

[ms-henglu]

@manicminer , hi, thanks for code review!

I've added a commit according to your suggestions, please take another look. Thanks!

[katbyte]

It looks like we need to add something to the docs on how to enable this?

------- Stdout: -------
=== RUN   TestAccCognitiveAccountCustomerManagedKey_basic
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_basic
=== CONT  TestAccCognitiveAccountCustomerManagedKey_basic
    testcase.go:89: Step 1/2 error: Error running apply: exit status 1
        
        Error: creating Account: (Name "acctest-cogacc-210716003904684244" / Resource Group "acctestRG-cognitive-210716003904684244"): cognitiveservices.AccountsClient#Create: Failure sending request: StatusCode=0 -- Original Error: Code="ResourceKindRequireAcceptTerms" Message="This subscription is not allowed to create Face. For details and taking actions please go to https://go.microsoft.com/fwlink/?linkid=2164191"
        
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 25, in resource "azurerm_cognitive_account" "test":
          25: resource "azurerm_cognitive_account" "test" {
        
--- FAIL: TestAccCognitiveAccountCustomerManagedKey_basic (269.53s)
FAIL

[ms-henglu]

It looks like we need to add something to the docs on how to enable this?

------- Stdout: -------
=== RUN   TestAccCognitiveAccountCustomerManagedKey_basic
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_basic
=== CONT  TestAccCognitiveAccountCustomerManagedKey_basic
    testcase.go:89: Step 1/2 error: Error running apply: exit status 1
        
        Error: creating Account: (Name "acctest-cogacc-210716003904684244" / Resource Group "acctestRG-cognitive-210716003904684244"): cognitiveservices.AccountsClient#Create: Failure sending request: StatusCode=0 -- Original Error: Code="ResourceKindRequireAcceptTerms" Message="This subscription is not allowed to create Face. For details and taking actions please go to https://go.microsoft.com/fwlink/?linkid=2164191"
        
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 25, in resource "azurerm_cognitive_account" "test":
          25: resource "azurerm_cognitive_account" "test" {
        
--- FAIL: TestAccCognitiveAccountCustomerManagedKey_basic (269.53s)
FAIL

Hi @katbyte, it seems that doc is helpful. It says

You must create your first Face, Text Analytics, or Computer Vision resources from the Azure portal to review and acknowledge the terms and conditions.

Could you please create a face resource from portal for the subscription? Thanks!

I'll add this to the doc.

[katbyte]

We have done that but the tests are still failing:

------- Stdout: -------
=== RUN   TestAccCognitiveAccountCustomerManagedKey_basic
=== PAUSE TestAccCognitiveAccountCustomerManagedKey_basic
=== CONT  TestAccCognitiveAccountCustomerManagedKey_basic
    testcase.go:88: Step 1/2 error: Error running apply: exit status 1
        
        Error: creating Account: (Name "acctest-cogacc-210720220504256420" / Resource Group "acctestRG-cognitive-210720220504256420"): cognitiveservices.AccountsClient#Create: Failure sending request: StatusCode=0 -- Original Error: Code="ResourceKindRequireAcceptTerms" Message="This subscription is not allowed to create Face. For details and taking actions please go to https://go.microsoft.com/fwlink/?linkid=2164191"
        
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 25, in resource "azurerm_cognitive_account" "test":
          25: resource "azurerm_cognitive_account" "test" {
        
--- FAIL: TestAccCognitiveAccountCustomerManagedKey_basic (272.41s)
FAIL

[ms-henglu]

I'll confirm it with service team.

[ms-henglu]

@katbyte , Hi, service team confirmed both of those subscriptions have the feature flag for CMK. Can you let me know if you see the E0 offer in the dropdown from the Ibiza portal when trying to create a Face resource?

[ms-henglu]

@katbyte , Hi, could you please check whether you can see a Enterprise E0 in pricing tier when create Face from azure portal?

[jackofallops]

@katbyte , Hi, could you please check whether you can see a Enterprise E0 in pricing tier when create Face from azure portal?

Hi @ms-henglu - After some digging we discovered that the blocker for this was actually a UI element in the portal that is only displayed when a US region is selected in the Face creation blade:

This tick box must be checked before any Face service can be deployed, regardless of region. This should probably be reported back to the service team?

Since that tick box was set (resource creation was not necessary) the tests now pass:

[ms-henglu]

@jackofallops , thanks! I'll report it to service team.

[katbyte]

@ms-henglu - could we add the information steve found out here so the users know to tick that ui element??

[katbyte]

Thanks @ms-henglu - LGTM 🙌

[tombuildsstuff]

@ms-henglu per your comment here it appears given the current API State this resource doesn't appear to be suitable for Terraform at this time, since deleting and recreating the parent resource during deletion will delete any data within this account, which isn't tracked.

For now I'm going to open a PR to revert this resource - but you'll need to reach out to the Service Team here.

[github-actions]

This functionality has been released in v2.71.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.