Gracefully degrade "List Account Keys" during plan phase

[mud5150]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Currently when running plan if the user does not have access to listKeys on the storage account resource the plan phase will fail. As mentioned in #3651 it could be totally fine, and intentional (least privilege), for the user running plan to not require this access. It would be good if the plan phase could gracefully degrade, perhaps returning empty strings, if the user doesn't have permission to listKeys.

New or Affected Resource(s)

• azurerm_storage_account

References

• Provider authentication to blob using Azure AD #3651

[ghost]

This has been released in version 1.34.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 1.34.0"
}
# ... other configuration ...

[secustor]

@tombuildsstuff
For the problem still occurs.

provider "azurerm" {
  version = "~> 1.34.0"

Log:

module.our_module.azurerm_storage_account.storage: Refreshing state... [id=/subscriptions/<subscription_id>/resourceGroups/<resource group>/providers/Microsoft.Storage/storageAccounts/<storage account name>]

Error: Error listing Keys for Storage Account "<storage account name>" (Resource Group "<resource group>"): storage.AccountsClient#ListKeys: Failure responding to request: StatusCode=403 -- Original    

Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client '<client id>' with object id '<object id is the same as client id>' does not have authorization to perform action 'Microsoft.Storage/storageAccounts/listKeys/action' over scope '/subscriptions/<subscription_id>/resourceGroups/<resource group>/providers/Microsoft.Storage/storageAccounts/<storage account name>' or the scope is invalid. If access was recently granted, please refresh your credentials."

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!