Segmentation Fault reading storage account with private link

[fabio-s-franco]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.7.4

AzureRM Provider Version

3.96.0_x5

Affected Resource(s)/Data Source(s)

azurerm_storage_account

Terraform Configuration Files

resource "azurerm_storage_account" "spoke_storage_account" {
  provider = azurerm.cluster_subscription

  name                            = local.storage_account_name
  location                        = local.static_config.locations.west_europe
  resource_group_name             = local.cluster_resourcegroup_name
  account_tier                    = "Premium"
  account_replication_type        = "ZRS"
  public_network_access_enabled   = true
  nfsv3_enabled                   = true
  account_kind                    = "BlockBlobStorage"
  is_hns_enabled                  = true
  allow_nested_items_to_be_public = false

  network_rules {
    virtual_network_subnet_ids = [ 
#....redacted
    ],

    ip_rules       = [] #redacted
    default_action = "Deny"
  }

  lifecycle {
    ignore_changes  = [network_rules[0].private_link_access, tags]
    prevent_destroy = true
  }
}

resource "azurerm_private_endpoint" "pe_blob" {
  provider = azurerm.hub

  name                = "redacted"
  location            = local.static_config.locations.west_europe
  resource_group_name = "redacted"
  subnet_id           = #redacted

  private_service_connection {
    name                           = "redacted"
    private_connection_resource_id = azurerm_storage_account.spoke_storage_account.id
    subresource_names              = ["blob"]
    is_manual_connection           = false
  }

  ip_configuration {
    name               = "pip-blob"
    private_ip_address = local.pe_blob_pvt_ip
    subresource_name   = "blob"
    member_name        = "blob"
  }

  private_dns_zone_group {
    name                 = "zone"
    private_dns_zone_ids = ["id"]
  }

  lifecycle {
    ignore_changes = [tags]
  }
}

Debug Output/Panic Output

Stack trace from the terraform-provider-azurerm_v3.96.0_x5 plugin:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x38 pc=0xbe50ef]

goroutine 168 [running]:
github.com/hashicorp/go-azure-sdk/sdk/client.(*Response).Unmarshal(0xc003d50940, {0x737ec40, 0xc003d3e7c0?})
        github.com/hashicorp/go-azure-sdk/sdk@v0.20240314.1083835/client/client.go:171 +0x4f
github.com/tombuildsstuff/giovanni/storage/2023-11-03/blob/accounts.Client.GetServiceProperties({0xc000d4bce0?}, {0x904d1c8, 0xc0017eff10}, {0xc002712bc8?, 0x9})
        github.com/tombuildsstuff/giovanni@v0.25.1/storage/2023-11-03/blob/accounts/get_service_properties.go:42 +0x235
github.com/hashicorp/terraform-provider-azurerm/internal/services/storage.resourceStorageAccountRead(0xc0023bb280, {0x7826420?, 0xc001821b00})
        github.com/hashicorp/terraform-provider-azurerm/internal/services/storage/storage_account_resource.go:2333 +0x2c2f
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).read(0x904d120?, {0x904d120?, 0xc003a342d0?}, 0xd?, {0x7826420?, 0xc001821b00?})
        github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:783 +0x163
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).RefreshWithoutUpgrade(0xc0019741c0, {0x904d120, 0xc003a342d0}, 0xc003a42410, {0x7826420, 0xc001821b00})
        github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:1089 +0x552
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ReadResource(0xc00021dd28, {0x904d120?, 0xc003a341e0?}, 0xc003a1e2c0)
        github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/grpc_provider.go:649 +0x48a
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).ReadResource(0xc000f9b680, {0x904d120?, 0xc0027fb800?}, 0xc001c00900)
        github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/tf5server/server.go:789 +0x48b
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ReadResource_Handler({0x8430e20?, 0xc000f9b680}, {0x904d120, 0xc0027fb800}, 0xc0017ef6c0, 0x0)
        github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:431 +0x169
google.golang.org/grpc.(*Server).processUnaryRPC(0xc0002661e0, {0x9074920, 0xc001ac6820}, 0xc003a03d40, 0xc001ab6b10, 0xe988c68, 0x0)
        google.golang.org/grpc@v1.58.3/server.go:1374 +0xde7
google.golang.org/grpc.(*Server).handleStream(0xc0002661e0, {0x9074920, 0xc001ac6820}, 0xc003a03d40, 0x0)
        google.golang.org/grpc@v1.58.3/server.go:1751 +0x9e7
google.golang.org/grpc.(*Server).serveStreams.func1.1()
        google.golang.org/grpc@v1.58.3/server.go:986 +0xbb
created by google.golang.org/grpc.(*Server).serveStreams.func1 in goroutine 38
        google.golang.org/grpc@v1.58.3/server.go:997 +0x145

Error: The terraform-provider-azurerm_v3.96.0_x5 plugin crashed!

This is always indicative of a bug within the plugin. It would be immensely
helpful if you could report the crash with the plugin's maintainers so that it
can be fixed. The output above should help diagnose the issue.

Expected Behaviour

No response

Actual Behaviour

I have updated a storage account that now can only be accessed via private link and private endpoint connection. During the update a runtime error occurred (unrelated). I had also moved the resource to a different module and imported it using terraform import.

When trying to apply all changes (after previous interruption), the provider now crashes. Private endpoint did not have a chance to be created and with the crash, I reached a deadlock. Currently experiencing an outtage so can give more details later.

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[fabio-s-franco]

I have confirmed that the crash is a result of the storage account being inaccessible to the provider. Due to the unrelated apply error, the private dns zone vnet association was not created, which in turn rendered the storage account inaccessible.

Though the plugin shouldn't crash in this case, looks like a null verification that is missing.

[manicminer]

@fabio-s-franco Thanks for taking the time to report this in detail, even whilst you're handling an outage.

You're right, the crash itself is due to a missing nil check which will be fixed by hashicorp/go-azure-sdk#932. Unfortunately there isn't much we can currently do to work around the inaccessible storage account, but we can certainly fix the crash.

[fabio-s-franco]

Unfortunately there isn't much we can currently do to work around the inaccessible storage account, but we can certainly fix the crash.

@manicminer

Of course, and I wasn't expecting so. I resolved the issue manually, then addressed the accessibility problem. I am glad the nil check issue was resolved, it can make it quicker to understand the problem.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.