How to Authorize Importing an Azure Storage Account into Terraform

If you’re using Terraform to manage your cloud infrastructure on Azure, you may need to import existing resources into your configuration. This can be a tricky process, especially when it comes to sensitive resources like storage accounts. In this article, we’ll show you how to authorize importing an Azure Storage Account into Terraform, step by step.

Introduction

Terraform is a popular infrastructure-as-code tool that enables users to manage their cloud infrastructure in a declarative way. With Terraform, you can define your infrastructure as code, allowing you to version, review, and modify your infrastructure with ease. Importing existing resources into your Terraform configuration is a useful feature that enables you to manage your existing infrastructure using Terraform. However, importing sensitive resources like Azure Storage Accounts requires authorization, and in this article, we’ll show you how to do it.

Understanding Terraform Import

Terraform Import is a command-line tool that enables you to import existing infrastructure into your Terraform configuration. When you import a resource, Terraform creates a state file that represents the resource and its dependencies in your Terraform configuration. This allows you to manage the resource using Terraform going forward. However, importing resources can be tricky, especially when you need to import sensitive resources like Azure Storage Accounts.

Prerequisites

Before you can import an Azure Storage Account into Terraform, you’ll need to have the following:

• An Azure subscription
• An Azure Storage Account that you want to import
• Terraform installed on your local machine
• Azure CLI installed on your local machine

Configuring Azure Storage Account for Import

To configure your Azure Storage Account for import, follow these steps:

1. Open the Azure portal and navigate to your Storage Account.
2. Click on “Access keys” under “Settings”.
3. Copy the “Connection string” for the Storage Account.

Granting Terraform Access to the Azure Storage Account

Before you can import the Azure Storage Account into Terraform, you’ll need to grant Terraform access to the Storage Account. To do this, follow these steps:

• Open a terminal window and log in to your Azure subscription using the Azure CLI.

az login

• Set your subscription.

az account set --subscription <subscription-id>

• Create a new service principal and assign it a role that enables it to manage the Storage Account.

az ad sp create-for-rbac --role="Storage Blob Data Contributor" --scopes="/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>"

• Note the “appId”, “password”, and “tenant” values returned by the command. You’ll need these values later.

Importing Azure Storage Account into Terraform

Now that you’ve configured your Azure Storage Account for import and granted Terraform access to the Storage Account, you can import it into Terraform. To do this, follow these steps:

1. Open a terminal window and navigate to the directory containing your Terraform configuration file.
2. Run the import command, using the Storage Account’s resource ID as the second argument.

terraform import azurerm_storage_account.<name> /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>

3. After running the import command, Terraform will create a state file for the Azure Storage Account. You can verify that the import was successful by running the “terraform state list” command, which will list all the resources in the Terraform state.

terraform state list

4. Now that the Azure Storage Account is imported into Terraform, you can manage it using your Terraform configuration.

Updating the Terraform Configuration File

After importing the Azure Storage Account into Terraform, you’ll need to update your Terraform configuration file to reflect the imported resource. To do this, follow these steps:

1. Open your Terraform configuration file in a text editor.
2. Add a new resource block for the imported Azure Storage Account, using the same resource type and name as the imported resource.

resource "azurerm_storage_account" "<name>" {
  name                     = "<storage-account-name>"
  resource_group_name      = "<resource-group>"
  location                 = "<location>"
  account_tier             = "<tier>"
  account_replication_type = "<replication-type>"
  tags                     = {
    environment = "<environment>"
  }
}

3. Replace the placeholders in the resource block with the actual values for your Azure Storage Account.
4. Save the Terraform configuration file.

Testing the Configuration

To test your updated Terraform configuration, follow these steps:

1. Open a terminal window and navigate to the directory containing your Terraform configuration file.
2. Run the “terraform plan” command to see the changes that Terraform will make.

terraform plan

3. If the plan looks correct, apply the changes by running the “terraform apply” command.

terraform apply

4. After the changes have been applied, verify that the Azure Storage Account has been updated as expected.

Troubleshooting Tips

If you encounter issues when importing your Azure Storage Account into Terraform, try these troubleshooting tips:

• Double-check that you’ve granted the correct permissions to the service principal.
• Ensure that you’re using the correct resource ID when running the import command.
• Verify that your Terraform configuration file reflects the correct resource type and name for the imported resource.

Conclusion

Importing an Azure Storage Account into Terraform can be a complex process, but by following the steps outlined in this article, you should be able to do it successfully. Remember to grant Terraform the correct permissions and update your Terraform configuration file as needed. With the Azure Storage Account imported into Terraform, you’ll be able to manage it alongside your other cloud resources, making it easier to maintain and modify your infrastructure.

FAQs

1. Can I import other Azure resources into Terraform using the same process? Yes, you can use Terraform Import to import other Azure resources into your Terraform configuration. The process will be similar to what we’ve outlined in this article.
2. What role should I assign to the service principal when granting it access to the Azure Storage Account? In this article, we’ve used the “Storage Blob Data Contributor” role, which provides read and write access to the Storage Account. You can use other roles as needed, depending on your requirements.
3. Can I import resources from other cloud providers into Terraform? Yes, Terraform supports importing resources from other cloud providers, including AWS, Google Cloud Platform, and more.
4. Will importing an Azure Storage Account into Terraform delete any existing data? No, importing a resource into Terraform will not delete any existing data. It simply creates a state file that represents the resource in your Terraform configuration.