New Data Source: azurerm_eventhub_sas

internal/services/eventhub/eventhub_sas_data_source.go

@@ -0,0 +1,82 @@
+package eventhub
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"time"
+
+	"github.com/hashicorp/go-azure-helpers/eventhub"
+	"github.com/hashicorp/terraform-provider-azurerm/helpers/validate"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/tf/pluginsdk"
+)
+
+const (
+	connStringSharedAccessKeyKey     = "SharedAccessKey"
+	connStringSharedAccessKeyNameKey = "SharedAccessKeyName"
+	connStringEndpointKey            = "Endpoint"
+	connStringEntityPathKey          = "EntityPath"
+)
+
+func dataSourceEventHubSharedAccessSignature() *pluginsdk.Resource {
+	return &pluginsdk.Resource{
+		Read: dataSourceEventHubSasRead,
+
+		Timeouts: &pluginsdk.ResourceTimeout{
+			Read: pluginsdk.DefaultTimeout(5 * time.Minute),
+		},
+
+		Schema: map[string]*pluginsdk.Schema{
+			"connection_string": {
+				Type:      pluginsdk.TypeString,
+				Required:  true,
+				Sensitive: true,
+			},
+
+			// Always in UTC and must be ISO-8601 format
+			"expiry": {
+				Type:         pluginsdk.TypeString,
+				Required:     true,
+				ValidateFunc: validate.ISO8601DateTime,
+			},
+
+			"sas": {
+				Type:      pluginsdk.TypeString,
+				Computed:  true,
+				Sensitive: true,
+			},
+		},
+	}
+}
+
+func dataSourceEventHubSasRead(d *pluginsdk.ResourceData, _ interface{}) error {
+	connString := d.Get("connection_string").(string)
+	expiry := d.Get("expiry").(string)
+
+	// Parse the connection string
+	kvp, err := eventhub.ParseEventHubSASConnectionString(connString)
+	if err != nil {
+		return err
+	}
+
+	sharedAccessKeyName := kvp[connStringSharedAccessKeyNameKey]
+	sharedAccessKey := kvp[connStringSharedAccessKeyKey]
+	endpoint := kvp[connStringEndpointKey]
+	entityPath := kvp[connStringEntityPathKey]
+	endpointUrl, err := eventhub.ComputeEventHubSASConnectionUrl(endpoint, entityPath)
+	if err != nil {
+		return err
+	}
+
+	sasToken, err := eventhub.ComputeEventHubSASToken(sharedAccessKeyName, sharedAccessKey, *endpointUrl, expiry)
+	if err != nil {
+		return err
+	}
+
+	sasConnectionString := eventhub.ComputeEventHubSASConnectionString(sasToken)
+
+	d.Set("sas", sasConnectionString)
+	tokenHash := sha256.Sum256([]byte(sasConnectionString))
+	d.SetId(hex.EncodeToString(tokenHash[:]))
+
+	return nil
+}

internal/services/eventhub/eventhub_sas_data_source_test.go

@@ -0,0 +1,84 @@
+package eventhub_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance"
+	"github.com/hashicorp/terraform-provider-azurerm/internal/acceptance/check"
+)
+
+type EventHubSharedAccessSignatureDataSource struct{}
+
+func TestAccEventHubSharedAccessSignatureDataSource_basic(t *testing.T) {
+	data := acceptance.BuildTestData(t, "data.azurerm_eventhub_sas", "test")
+	r := EventHubSharedAccessSignatureDataSource{}
+	utcNow := time.Now().UTC()
+	endDate := utcNow.Add(time.Hour * 24).Format(time.RFC3339)
+
+	data.DataSourceTest(t, []acceptance.TestStep{
+		{
+			Config: r.basic(data, endDate),
+			Check: acceptance.ComposeTestCheckFunc(
+				check.That(data.ResourceName).Key("sas").Exists(),
+			),
+		},
+	})
+}
+
+func (EventHubSharedAccessSignatureDataSource) basic(data acceptance.TestData, endDate string) string {
+	return fmt.Sprintf(`
+provider "azurerm" {
+  features {}
+}
+
+resource "azurerm_resource_group" "test" {
+  name     = "acctestRG-ehn-%d"
+  location = "%s"
+}
+
+resource "azurerm_eventhub_namespace" "test" {
+  name                = "acctest-ehn-%d"
+  location            = azurerm_resource_group.test.location
+  resource_group_name = azurerm_resource_group.test.name
+  sku                 = "Basic"
+}
+
+resource "azurerm_eventhub" "test" {
+  name                = "acctest-eh-%d"
+  namespace_name      = azurerm_eventhub_namespace.test.name
+  resource_group_name = azurerm_resource_group.test.name
+  partition_count     = 1
+  message_retention   = 1
+}
+
+resource "azurerm_eventhub_authorization_rule" "test" {
+  name                = "acctest-ehar-%d"
+  namespace_name      = azurerm_eventhub_namespace.test.name
+  eventhub_name       = azurerm_eventhub.test.name
+  resource_group_name = azurerm_resource_group.test.name
+
+  listen = true
+  send   = true
+  manage = true
+}
+
+data "azurerm_eventhub_authorization_rule" "test" {
+  name                = azurerm_eventhub_authorization_rule.test.name
+  namespace_name      = azurerm_eventhub_namespace.test.name
+  eventhub_name       = azurerm_eventhub.test.name
+  resource_group_name = azurerm_resource_group.test.name
+}
+
+data "azurerm_eventhub_sas" "test" {
+  connection_string = data.azurerm_eventhub_authorization_rule.test.primary_connection_string
+  expiry            = "%s"
+}
+
+output "sas_token" {
+  value     = replace(data.azurerm_eventhub_sas.test.sas, "\u0026", "&")
+  sensitive = true
+}
+`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger, data.RandomInteger, endDate)
+}

internal/services/eventhub/registration.go

@@ -30,6 +30,7 @@ func (r Registration) SupportedDataSources() map[string]*pluginsdk.Resource {
 	return map[string]*pluginsdk.Resource{
 		"azurerm_eventhub":                              dataSourceEventHub(),
 		"azurerm_eventhub_cluster":                      dataSourceEventHubCluster(),
+		"azurerm_eventhub_sas":                          dataSourceEventHubSharedAccessSignature(),
 		"azurerm_eventhub_authorization_rule":           EventHubAuthorizationRuleDataSource(),
 		"azurerm_eventhub_consumer_group":               EventHubConsumerGroupDataSource(),
 		"azurerm_eventhub_namespace":                    EventHubNamespaceDataSource(),

vendor/modules.txt

@@ -119,6 +119,7 @@ github.com/hashicorp/errwrap
 # github.com/hashicorp/go-azure-helpers v0.56.0
 ## explicit; go 1.19
 github.com/hashicorp/go-azure-helpers/authentication
+github.com/hashicorp/go-azure-helpers/eventhub
 github.com/hashicorp/go-azure-helpers/lang/dates
 github.com/hashicorp/go-azure-helpers/lang/pointer
 github.com/hashicorp/go-azure-helpers/lang/response

website/docs/d/eventhub_sas.html.markdown

@@ -0,0 +1,79 @@
+---
+subcategory: "Messaging"
+layout: "azurerm"
+page_title: "Azure Resource Manager: azurerm_eventhub_sas"
+description: |-
+  Gets a Shared Access Signature (SAS Token) for an existing Event Hub.
+---
+
+# Data Source: azurerm_eventhub_sas
+
+Use this data source to obtain a Shared Access Signature (SAS Token) for an existing Event Hub.
+
+## Example Usage
+
+```hcl
+resource "azurerm_resource_group" "example" {
+  name     = "example-resources"
+  location = "West Europe"
+}
+
+resource "azurerm_eventhub_namespace" "example" {
+  name                = "example-ehn"
+  location            = azurerm_resource_group.example.location
+  resource_group_name = azurerm_resource_group.example.name
+  sku                 = "Basic"
+}
+
+resource "azurerm_eventhub" "example" {
+  name                = "example-eh"
+  namespace_name      = azurerm_eventhub_namespace.example.name
+  resource_group_name = azurerm_resource_group.example.name
+  partition_count     = 1
+  message_retention   = 1
+}
+
+resource "azurerm_eventhub_authorization_rule" "example" {
+  name                = "example-ehar"
+  namespace_name      = azurerm_eventhub_namespace.example.name
+  eventhub_name       = azurerm_eventhub.example.name
+  resource_group_name = azurerm_resource_group.example.name
+
+  listen = true
+  send   = true
+  manage = true
+}
+
+data "azurerm_eventhub_authorization_rule" "example" {
+  name                = azurerm_eventhub_authorization_rule.example.name
+  namespace_name      = azurerm_eventhub_namespace.example.name
+  eventhub_name       = azurerm_eventhub.example.name
+  resource_group_name = azurerm_resource_group.example.name
+}
+
+data "azurerm_eventhub_sas" "example" {
+  connection_string = data.azurerm_eventhub_authorization_rule.example.primary_connection_string
+  expiry            = "2023-06-23T00:00:00Z"
+}
+
+output "sas_token" {
+  value     = replace(data.azurerm_eventhub_sas.test.sas, "\u0026", "&")
+  sensitive = true
+}
+```
+
+## Argument Reference
+
+* `connection_string` - The connection string for the Event Hub to which this SAS applies.
+
+* `expiry` - The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
+
+## Attributes Reference
+
+* `sas` - The computed Event Hub Shared Access Signature (SAS).
+
+## Timeouts
+
+The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/language/resources/syntax#operation-timeouts) for certain actions:
+
+* `read` - (Defaults to 5 minutes) Used when retrieving the SAS Token.