azurerm_cognitive_account : fix crash when key_vault_key_id is nil

[sinbai]

Fix plugin crash when key_vault_key_id is nil, fix #28357.

[catriona-m]

Thanks @sinbai - could we add a test here which switches from using a customer managed key to microsoft managed to confirm that this will fix the linked issue?

[sinbai]

which switches from using a customer managed key to microsoft managed

Hi @catriona-m thanks for your feedback. When I added a test to switch from using customer managed keys to Microsoft managed keys, I found that the current TF implementation cannot make the switch. Here's why:

When creating azurerm_cognitive_account, customer_managed_key was not specified, and the API did not return the default Encryption type(corresponding to the keySource in the API. According to the document "By default, Microsoft creates and manages your resources in a Microsoft-owned Azure subscription and uses a Microsoft-managed key to encrypt the data.", the default Encryption type should be Microsoft Managed Keys (Corresponding to Microsoft.CognitiveServices. And what is actually displayed on the portal is Microsoft Managed Keys).

However, when updating resource azurerm_cognitive_account (switching from using customer managed keys to Microsoft managed keys), deleting customer_managed_key (setting Encryption = nil), the API does not return an error, but the switch is actually unsuccessful. After verifying the API behavior, it was found that the API needs to explicitly specify the API property keySource as Microsoft.CognitiveServices in order to update successfully.

So while adding the test, I updated the code (when sending the API request without specifying customer_managed_key, specify the keysource value as Microsoft.CognitiveServices) so that the update can succeed. Could you please take another look?

Test result:
PASS: TestAccCognitiveAccount_customerManagedKey (440.27s)

[catriona-m]

Thanks for updating this @sinbai. It looks like there are some test failures related to this, but once those are addressed I can take another look. Thanks!

------- Stdout: -------
=== RUN   TestAccCognitiveAccount_basic
=== PAUSE TestAccCognitiveAccount_basic
=== CONT  TestAccCognitiveAccount_basic
    testcase.go:173: Step 1/3 error: Error running apply: exit status 1
        Error: creating Account (Subscription: "*******"
        Resource Group Name: "acctestRG-cognitive-250314103054145747"
        Account Name: "acctestcogacc-250314103054145747"): unexpected status 400 (400 Bad Request) with error: BringOwnFeatureNotEnabled: Bring your own feature is not enabled for Subscription/SKU/Kind.
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 40, in resource "azurerm_cognitive_account" "test":
          40: resource "azurerm_cognitive_account" "test" {
--- FAIL: TestAccCognitiveAccount_basic (109.26s)
FAIL

[sinbai]

using a customer managed key to microsoft managed

Thanks for updating this @sinbai. It looks like there are some test failures related to this, but once those are addressed I can take another look. Thanks!

------- Stdout: -------
=== RUN   TestAccCognitiveAccount_basic
=== PAUSE TestAccCognitiveAccount_basic
=== CONT  TestAccCognitiveAccount_basic
    testcase.go:173: Step 1/3 error: Error running apply: exit status 1
        Error: creating Account (Subscription: "*******"
        Resource Group Name: "acctestRG-cognitive-250314103054145747"
        Account Name: "acctestcogacc-250314103054145747"): unexpected status 400 (400 Bad Request) with error: BringOwnFeatureNotEnabled: Bring your own feature is not enabled for Subscription/SKU/Kind.
          with azurerm_cognitive_account.test,
          on terraform_plugin_test.tf line 40, in resource "azurerm_cognitive_account" "test":
          40: resource "azurerm_cognitive_account" "test" {
--- FAIL: TestAccCognitiveAccount_basic (109.26s)
FAIL

Hi @catriona-m thanks for your feedback. I have updated the code, could you please take another look?

[catriona-m]

Thanks @sinbai LGTM!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.