Support for "preferred_data_persistence_auth_method" in Azure Redis Cache Configuration

[YokojimaSkewers]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Hello Terraform Provider Team,

I am currently utilizing the Terraform AzureRM provider to manage Azure Redis Cache resources. I've come across a limitation that I believe could benefit from enhancement. Specifically, I am looking to set the preferred-data-persistence-auth-method to managedIdentity for a more streamlined and secure management of my Redis Cache instances.
(Microsoft document)

Issue Description:

The current Terraform AzureRM provider does not seem to support configuring the preferred-data-persistence-auth-method for Azure Redis Cache. This setting is crucial for scenarios where enhanced security and automated identity management are required, especially in production environments.

Suggested Feature:

I propose the addition of support for the preferred_data_persistence_auth_method attribute within the azurerm_redis_cache resource. Ideally, this would allow users to specify the persistence method directly in the Terraform configuration, enhancing the capabilities and security compliance of Terraform-managed Redis instances.

Use Case:

In my use case, setting the preferred-data-persistence-auth-method to managedIdentity is critical for maintaining compliance and automating identity management. Without this feature, manual intervention or additional scripting is required, reducing the effectiveness and benefits of infrastructure as code.

New or Affected Resource(s)/Data Source(s)

azurerm_redis_cache

Potential Terraform Configuration

No response

References

No response

[rcskosir]

Thank you for taking the time to open this feature request!

[MichalSino]

Do we know when this will come to provider?

[MichalSino]

@catriona-m When we are enabling MI for connection to SA in Portal , in ARM tamplate the parameter "rdb-sttorage-connection-string" contains only storage account endpoint address instead of whole connection string. Will it also be modified in new version? now I got message "unexpected status 400 with error: InvalidRequestBody: The value of the parameter 'properties.redisConfiguration.rdb-storage-connection-string' is invalid."

[Xaxetrov]

To users having the error "unexpected status 400 with error: InvalidRequestBody: The value of the parameter 'properties.redisConfiguration.rdb-storage-connection-string' is invalid." (@MichalSino, maybe this will help):

Warning

As the documentation was suggesting, my team had an ignore_changes block on rdb_storage_connection_string.

Because of azurerm_redis_cache update on v3.93 (support for data_persistence_authentication_method), some minor changes on our resources had to be made but could not. Maybe because of a bug, maybe because the connection string actually changed (I checked and am pretty sure it did not).

By removing rdb_storage_connection_string from ignore_changes, I could apply the pipeline successfully. Then I had to restore the ignore_changes block to avoid the documented problem.

Hope this helps and if this is a problem for a lot of users it could be great to amend the patch note or communicate in some way about that. See also (unrelated issue but person having the same problem)

Have a good day.

[MichalSino]

No, we don't need to do that. We can put blob endpoi t instead of connection string and it works. Tested on azurerm 3.94.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.