New Resource: `azurerm_cloud_hardware_security_module_cluster` by wuxu92 · Pull Request #30293 · hashicorp/terraform-provider-azurerm

wuxu92 · 2025-08-01T06:48:03Z

Community Note

Please vote on this PR by adding a 👍 reaction to the original PR to help the community and maintainers prioritize for review
Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for PR followers and do not help prioritize for review

Description

Documentation: https://learn.microsoft.com/en-us/azure/cloud-hsm/

The current version only support fixed Sku, so this resource intentionally doesn't expose SKU properties. it also only support useridentity while the swagger definition is SystemAndUserAssignedIdentity, and PublicNetworkAccess only support Disabled, so does not expose either.

PR Checklist

I have followed the guidelines in our Contributing Documentation.
I have checked to ensure there aren't other open Pull Requests for the same update/change.
I have checked if my changes close any open issues. If so please include appropriate closing keywords below.
I have updated/added Documentation as required written in a helpful and kind way to assist users that may be unfamiliar with the resource / data source.
I have used a meaningful PR title to help maintainers and other users understand this change and help prevent duplicate work.
For example: “resource_name_here - description of change e.g. adding property new_property_name_here”

Changes to existing Resource / Data Source

I have added an explanation of what my changes do and why I'd like you to include them (This may be covered by linking to an issue above, but may benefit from additional explanation).
I have written new tests for my resource or datasource changes & updated any relevant documentation.
I have successfully run tests with my changes locally. If not, please provide details on testing challenges that prevented you running the tests.
(For changes that include a state migration only). I have manually tested the migration path between relevant versions of the provider.

Testing

My submission includes Test coverage as described in the Contribution Guide and the tests pass. (if this is not possible for any reason, please include details of why you did or could not add test coverage)

--- PASS: TestAccCloudHardwareSecurityModuleCluster_update (1566.59s)
--- PASS: TestAccCloudHardwareSecurityModuleCluster_requiresImport (1627.74s)
--- PASS: TestAccCloudHardwareSecurityModuleCluster_complete (1657.24s)
--- PASS: TestAccCloudHardwareSecurityModuleCluster_privateEndpoint (1863.45s)
--- PASS: TestAccCloudHardwareSecurityModuleCluster_userAssignedIdentity (2737.66s)
--- PASS: TestAccCloudHardwareSecurityModuleCluster_basic (2793.65s)

Change Log

Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.

New Resource: azurerm_cloud_hardware_security_module_cluster

This is a (please select all that apply):

Bug Fix
New Feature (ie adding a service, resource, or data source)
Enhancement
Breaking Change

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the provider.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Note

If this PR changes meaningfully during the course of review please update the title and description as required.

ms-zhenhua

Hi @wuxu92 ,

Thanks for the PR. I've taken a look through and left some comments inline. If we can fix those up, this should be good to continue 👍

internal/services/hsm/cloud_hardware_security_module_cluster_resource.go

internal/services/hsm/cloud_hardware_security_module_cluster_resource_test.go

ms-zhenhua · 2025-08-04T08:46:35Z

internal/services/hsm/cloud_hardware_security_module_cluster_resource_test.go

+provider "azurerm" {
+  features {}
+}


The provider block should be put in each testcase.

sorry, I didn't get this comment, this is in a template method so it applies to each testcase, what change is required here?

Use this as an example, could you put provider definition in each testcase of basic, complete, update...?

Is this kind of new guideline? I see there are lots of tests put the provider definition in the template instead of each case.

It's not new, you may refer to the example of the guidance.

However, this example does not specify whether the provider block should be placed in the template method or a specific method. Most of the existing template methods contain the provider block..

internal/services/hsm/validate/cloud_hardware_security_module_name_valite.go

internal/services/hsm/cloud_hardware_security_module_cluster_resource.go

ms-zhenhua · 2025-08-18T08:36:38Z

internal/services/hsm/cloud_hardware_security_module_cluster_resource_test.go

+provider "azurerm" {
+  features {}
+}


Use this as an example, could you put provider definition in each testcase of basic, complete, update...?

internal/services/hsm/custompollers/cloud_hsm_cluster_state_poller.go

internal/services/hsm/validate/cloud_hardware_security_module_name_test.go

internal/services/hsm/cloud_hardware_security_module_cluster_resource.go

internal/services/hsm/cloud_hardware_security_module_cluster_resource_test.go

Co-authored-by: Zhenhua Hu <zhhu@microsoft.com>

ms-zhenhua

LGTM~

magodo

Thanks for this PR!
I've taken a look through and left some comments inline, but this is mostly looking good to me 👍

internal/services/hsm/custompollers/cloud_hsm_cluster_state_poller.go

internal/services/hsm/validate/cloud_hardware_security_module_name.go

magodo · 2025-12-15T02:16:20Z

internal/services/hsm/cloud_hardware_security_module_cluster_resource.go

+			Computed: true,
+		},
+
+		"hsms": {


Will there be more than one hsm's information returned?

yes, there are 3 hsms by default, and the current API doesn't support customize. I'm renaming it to hsm.

If there are 3, then we can keep it to be plural as in the flattening code you are still populating all of them?

Oh, I mixed up the plural rule and have reverted back to using "hsms". I'm wondering if it's acceptable to use "hsms" here, or if I should use the full name "hardware_security_modules" instead of the abbreviation(there were already "hsm_xx" properties in the provider).

I'm not sure, let's keep hsms first...

internal/services/hsm/cloud_hardware_security_module_cluster_resource.go

internal/services/hsm/cloud_hardware_security_module_cluster_resource_test.go

magodo · 2025-12-15T02:33:06Z

internal/services/hsm/cloud_hardware_security_module_cluster_resource.go

+				resp, err := client.Delete(ctx, *id)
+				if err != nil {
+					if response.WasConflict(resp.HttpResponse) {
+						return pluginsdk.RetryableError(err)


How come this is a retryable error? A retry on a Cloud HSM whose PE is deleted beforehead will succeed?

Yes a retry is required here, as the CloudHSM will under updating status when and a while after the deletion of the linked PE. so when run terraform destroy, the PE is deleted firstly then to delete the Cloud HSM, and the conflict error responded and a retry may succeed. this is confirmed by service team: cloud hsm should be in-progress for a max of 5 mins after deleting a private endpoint

This also seems to be like a service issue. Did the service team mention they have any plan to improve this?

Yes it's a service issue. I know other resources linked to a PE don't encounter such issue and HSM team is aware of it. I need to confirm with them again about the fix as they once indicated a way to improve the deletion in next version.

wuxu92 requested review from a team, WodansSon and magodo as code owners August 1, 2025 06:48

github-actions bot added documentation dependencies service/hsm size/XL waiting-response and removed waiting-response labels Aug 1, 2025

mybayern1974 assigned magodo Aug 1, 2025

github-actions bot removed the waiting-response label Aug 1, 2025

mybayern1974 assigned ms-zhenhua and unassigned magodo Aug 1, 2025

ms-zhenhua suggested changes Aug 5, 2025

View reviewed changes

github-actions bot added waiting-response and removed waiting-response labels Aug 5, 2025

wuxu92 force-pushed the apex/cloudhsm branch from 02c4432 to f89703c Compare August 5, 2025 05:22

github-actions bot removed the waiting-response label Aug 5, 2025

rcskosir added the new-resource label Aug 6, 2025

ms-zhenhua suggested changes Aug 18, 2025

View reviewed changes

github-actions bot added the waiting-response label Aug 18, 2025

wuxu92 added the ai-assisted label Aug 27, 2025

github-actions bot added waiting-response and removed waiting-response labels Aug 29, 2025

wuxu92 added 2 commits December 1, 2025 10:11

code/doc format update

517d388

Merge remote-tracking branch 'origin/main' into apex/cloudhsm

c9f81eb

github-actions bot removed the waiting-response label Nov 30, 2025

wuxu92 added 3 commits December 1, 2025 10:47

code format

bc73649

doc format

d11c2cc

fix update request body

2eca996

ms-zhenhua suggested changes Dec 9, 2025

View reviewed changes

github-actions bot added the waiting-response label Dec 9, 2025

Apply suggestions from code review

3a1fad4

Co-authored-by: Zhenhua Hu <zhhu@microsoft.com>

github-actions bot removed the waiting-response label Dec 9, 2025

update copyright

cf4634d

ms-zhenhua approved these changes Dec 9, 2025

View reviewed changes

magodo requested changes Dec 15, 2025

View reviewed changes

github-actions bot assigned magodo Dec 15, 2025

github-actions bot added the waiting-response label Dec 15, 2025

code format and remove unnecessary attributes

16c76b3

github-actions bot removed the waiting-response label Dec 15, 2025

wuxu92 added 2 commits December 15, 2025 16:03

rename hsms to hsm

25d1a00

code format

257a28b

github-actions bot added the waiting-response label Dec 15, 2025

use hsms property name

52a8359

github-actions bot added waiting-response and removed waiting-response labels Dec 15, 2025

wuxu92 removed the waiting-response label Jan 6, 2026

wuxu92 requested a review from magodo January 6, 2026 00:19

Merge branch 'main' into apex/cloudhsm

43f0bf5

github-actions bot added the waiting-response label Jan 29, 2026

wuxu92 added 3 commits February 16, 2026 16:04

Merge remote-tracking branch 'origin/main' into apex/cloudhsm

94b3907

naming, format and remove unused properties

9064c66

Merge remote-tracking branch 'origin/main' into apex/cloudhsm

1ae9635

Conversation

wuxu92 commented Aug 1, 2025

Community Note

Description

PR Checklist

Changes to existing Resource / Data Source

Testing

Change Log

Rollback Plan

Changes to Security Controls

Uh oh!

ms-zhenhua left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ms-zhenhua left a comment

Choose a reason for hiding this comment

Uh oh!

magodo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

magodo Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

magodo Dec 15, 2025 •

edited

Loading