Skip to content

chore: implement identity-based connections for queue trigger and output#656

Merged
silvicir merged 2 commits intomasterfrom
replace-storage-account-connection-string-with-managed-identities
Jan 12, 2026
Merged

chore: implement identity-based connections for queue trigger and output#656
silvicir merged 2 commits intomasterfrom
replace-storage-account-connection-string-with-managed-identities

Conversation

@silvicir
Copy link
Contributor

No description provided.

@silvicir silvicir requested review from a team as code owners January 12, 2026 09:06
@silvicir silvicir requested review from grausof and manuraf and removed request for a team January 12, 2026 09:06
@github-actions
Copy link
Contributor

📋 Pre-commit Output Log
[INFO] Initializing environment for https://github.com/pagopa/dx.
[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
Lock Terraform Registry modules......................(no files to check)Skipped

Generated on Mon Jan 12 09:07:03 UTC 2026
Run lock_modules on folder: infra/resources/psn/prod/

@silvicir silvicir temporarily deployed to infra-psn-prod-ci January 12, 2026 09:07 — with GitHub Actions Inactive
@github-actions
Copy link
Contributor

Tip

✅ All Terraform module locks are up to date

No module changes detected - everything is in sync!

📋 Pre-commit Output Log
[INFO] Initializing environment for https://github.com/pagopa/dx.
[INFO] Initializing environment for https://github.com/antonbabenko/pre-commit-terraform.
Lock Terraform Registry modules..........................................Passed

Generated on Mon Jan 12 09:07:06 UTC 2026
Run lock_modules on folder: infra/resources/prod/

@github-actions
Copy link
Contributor

📖 Terraform Plan (infra/resources/psn/prod) - success

Show Plan
Plan: 6 to add, 21 to change, 40 to destroy.

Full plan output was too long and was omitted. Check the workflow logs for full details.

@github-actions
Copy link
Contributor

📖 Terraform Plan (infra/resources/prod) - success

Show Plan
  # azurerm_api_management_api.wallet_user_ioapp_v1 will be updated in-place
  ~ resource "azurerm_api_management_api" "wallet_user_ioapp_v1" {
        id                    = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/wallet-user-ioapp-api-v1;rev=1"
        name                  = "wallet-user-ioapp-api-v1"
      ~ path                  = "api/echo" -> "api/wallet"
        # (16 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # azurerm_api_management_api.wallet_user_uat_ioapp_v1 will be updated in-place
  ~ resource "azurerm_api_management_api" "wallet_user_uat_ioapp_v1" {
        id                    = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/wallet-user-uat-ioapp-api-v1;rev=1"
        name                  = "wallet-user-uat-ioapp-api-v1"
      ~ path                  = "api/echo/uat" -> "api/wallet/uat"
        # (16 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # azurerm_api_management_api_policy.wallet_user_uat_v1 will be updated in-place
  ~ resource "azurerm_api_management_api_policy" "wallet_user_uat_v1" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/wallet-user-uat-ioapp-api-v1"
      ~ xml_content         = <<-EOT
          - <policies>
          + <policies>
          - 	<inbound>
          +   <inbound>
          - 		<include-fragment fragment-id="io-wallet-app-session-fragment" />
          +       <include-fragment fragment-id="io-wallet-app-session-fragment" />
          - 		<base />
          +       <base />
          - 		<!--<rewrite-uri template="@("/api/wallet/uat/v1/" + context.Request.Url.Path)" />-->
          +       <rewrite-uri template="@("/api/wallet/uat/v1/" + context.Request.Url.Path)" />
          - 		<set-backend-service backend-id="psn-uat-backend-01" />
          +       <set-backend-service backend-id="psn-backend-01" />
          - 	</inbound>
          +   </inbound>
          - 	<backend>
          +   <backend>
          - 		<base />
          +     <base />
          - 	</backend>
          +   </backend>
          - 	<outbound>
          +   <outbound>
          - 		<base />
          +     <base />
          - 	</outbound>
          +   </outbound>
          - 	<on-error>
          +   <on-error>
          - 		<base />
          +     <base />
          - 	</on-error>
          +   </on-error>
            </policies>
        EOT
        # (3 unchanged attributes hidden)
    }

  # azurerm_api_management_api_policy.wallet_user_v1 will be updated in-place
  ~ resource "azurerm_api_management_api_policy" "wallet_user_v1" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/apis/wallet-user-ioapp-api-v1"
      ~ xml_content         = <<-EOT
          - <policies>
          + <policies>
          - 	<inbound>
          +   <inbound>
          - 		<include-fragment fragment-id="io-wallet-app-session-fragment" />
          +       <include-fragment fragment-id="io-wallet-app-session-fragment" />
          - 		<base />
          +       <base />
          - 		<!--<rewrite-uri template="@("/api/wallet/v1/" + context.Request.Url.Path)" />-->
          +       <rewrite-uri template="@("/api/wallet/v1/" + context.Request.Url.Path)" />
          - 		<set-backend-service backend-id="psn-backend-01" />
          +       <set-backend-service backend-id="psn-backend-01" />
          - 	</inbound>
          +   </inbound>
          - 	<backend>
          +   <backend>
          - 		<base />
          +     <base />
          - 	</backend>
          +   </backend>
          - 	<outbound>
          +   <outbound>
          - 		<base />
          +     <base />
          - 	</outbound>
          +   </outbound>
          - 	<on-error>
          +   <on-error>
          - 		<base />
          +     <base />
          - 	</on-error>
          +   </on-error>
            </policies>
        EOT
        # (4 unchanged attributes hidden)
    }

  # azurerm_api_management_backend.psn will be updated in-place
  ~ resource "azurerm_api_management_backend" "psn" {
        id                  = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/backends/psn-backend-01"
        name                = "psn-backend-01"
      ~ url                 = "https://api.internal.wallet.io.pagopa.it/api/wallet/v1" -> "https://api.internal.wallet.io.pagopa.it/"
        # (6 unchanged attributes hidden)

      - credentials {
          - certificate = [] -> null
          - header      = {} -> null
          - query       = {} -> null
        }

      - tls {
          - validate_certificate_chain = false -> null
          - validate_certificate_name  = false -> null
        }
    }

  # azurerm_api_management_policy_fragment.wallet_authentication will be updated in-place
  ~ resource "azurerm_api_management_policy_fragment" "wallet_authentication" {
        id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-platform-api-gateway-apim-01/policyFragments/io-wallet-app-session-fragment"
        name              = "io-wallet-app-session-fragment"
      ~ value             = <<-EOT
          - <fragment>
          - 	<choose>
          - 		<when condition="@(!context.Variables.ContainsKey("skipSessionFragment"))">
          - 			<!-- Extract the token from the Authorization Header -->
          - 			<set-variable name="token" value="@{
          + <fragment>
          + 	<!-- Extract the token from the Authorization Header -->
          +   <set-variable name="token" value="@{
                string[] values;
                return context.Request.Headers.TryGetValue("Authorization", out values) ? values.FirstOrDefault() : "";
          -   }" />
          - 			<!-- Check if the Authorization header is valid, if not return 401 Unauthorized -->
          - 			<choose>
          - 				<when condition="@(
          +   }" />
          +   <!-- Check if the Authorization header is valid, if not return 401 Unauthorized -->
          +   <choose>
          +     <when condition="@(
                  string.IsNullOrEmpty((string)context.Variables["token"]) ||
                  !(((string)context.Variables["token"]).StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)) ||
                  string.IsNullOrWhiteSpace(((string)context.Variables["token"]).Substring(7))
          -     )">
          - 					<set-header name="Content-Type" exists-action="override">
          - 						<value>application/json</value>
          - 					</set-header>
          - 					<return-response>
          - 						<set-status code="401" reason="Unauthorized" />
          - 						<set-body>{"title": "Proxy Error", "status": 401, "detail": "Unauthorized"}</set-body>
          - 					</return-response>
          - 				</when>
          - 			</choose>
          - 			<!-- Call the session manager, pasing the bearer token, to get the user identity -->
          - 			<send-request mode="new" response-variable-name="introspectionResponse" timeout="10" ignore-error="false">
          - 				<set-url>https://io-p-weu-session-manager-app-03.azurewebsites.net/api/auth/v1/user-identity</set-url>
          - 				<set-method>GET</set-method>
          - 				<set-header name="Content-Type" exists-action="override">
          - 					<value>application/json</value>
          - 				</set-header>
          - 				<set-header name="Authorization" exists-action="override">
          - 					<value>@(((string)context.Variables["token"]))</value>
          - 				</set-header>
          - 			</send-request>
          - 			<choose>
          - 				<!-- If 200 return set the x-user header as the base64 of the response -->
          - 				<when condition="@(((IResponse)context.Variables["introspectionResponse"]).StatusCode == 200)">
          - 					<!-- Parse the introspectionResponse as a string -->
          - 					<set-variable name="userData" value="@(((IResponse)context.Variables["introspectionResponse"]).Body.As&lt;string&gt;())" />
          - 					<!-- Remove the Authorization Header -->
          - 					<set-header name="Authorization" exists-action="delete" />
          - 					<!-- Set the x-user header with the user data -->
          - 					<set-header name="x-user" exists-action="override">
          - 						<value>@(
          +     )">
          +       <set-header name="Content-Type" exists-action="override">
          +         <value>application/json</value>
          +       </set-header>
          +       <return-response>
          +         <set-status code="401" reason="Unauthorized" />
          +         <set-body>{"title": "Proxy Error", "status": 401, "detail": "Unauthorized"}</set-body>
          +       </return-response>
          +   </when>
          +   </choose>
          +   <!-- Call the session manager, pasing the bearer token, to get the user identity -->
          + 	<send-request mode="new" response-variable-name="introspectionResponse" timeout="10" ignore-error="false">
          + 		<set-url>https://io-p-weu-session-manager-app-03.azurewebsites.net/api/auth/v1/user-identity</set-url>
          + 		<set-method>GET</set-method>
          + 		<set-header name="Content-Type" exists-action="override">
          +       <value>application/json</value>
          + 		</set-header>
          + 		<set-header name="Authorization" exists-action="override">
          +       <value>@(((string)context.Variables["token"]))</value>
          + 		</set-header>
          + 	</send-request>
          + 	<choose>
          +     <!-- If 200 return set the x-user header as the base64 of the response -->
          + 		<when condition="@(((IResponse)context.Variables["introspectionResponse"]).StatusCode == 200)">
          + 			<!-- Parse the introspectionResponse as a string -->
          + 			<set-variable name="userData" value="@(((IResponse)context.Variables["introspectionResponse"]).Body.As&lt;string&gt;())" />
          + 			<!-- Remove the Authorization Header -->
          + 			<set-header name="Authorization" exists-action="delete" />
          + 			<!-- Set the x-user header with the user data -->
          + 			<set-header name="x-user" exists-action="override">
          + 				<value>@(
                      Convert.ToBase64String(
                          System.Text.Encoding.UTF8.GetBytes(((string)context.Variables["userData"]))
                      )
          -         )</value>
          - 					</set-header>
          - 				</when>
          - 				<when condition="@(((IResponse)context.Variables["introspectionResponse"]).StatusCode == 401)">
          - 					<return-response response-variable-name="introspectionErrorResponse">
          - 						<set-status code="401" reason="Unauthorized" />
          - 						<set-body>{"title": "Proxy Error", "status": 401, "detail": "Unauthorized"}</set-body>
          - 					</return-response>
          - 				</when>
          - 				<otherwise>
          - 					<set-header name="Content-Type" exists-action="override">
          - 						<value>application/json</value>
          - 					</set-header>
          - 					<return-response response-variable-name="introspectionErrorResponse">
          - 						<set-status code="500" reason="Internal Server Error" />
          - 						<set-body>{"title": "Proxy Error", "status": 401, "detail": "Unauthorized"}</set-body>
          - 					</return-response>
          - 				</otherwise>
          - 			</choose>
          - 		</when>
          - 	</choose>
          +         )</value>
          + 			</set-header>
          + 		</when>
          + 		<when condition="@(((IResponse)context.Variables["introspectionResponse"]).StatusCode == 401)">
          + 			<return-response response-variable-name="introspectionErrorResponse">
          + 				<set-status code="401" reason="Unauthorized" />
          +           <set-body>{"title": "Proxy Error", "status": 401, "detail": "Unauthorized"}</set-body>
          + 			</return-response>
          + 		</when>
          + 		<otherwise>
          + 			<set-header name="Content-Type" exists-action="override">
          +         <value>application/json</value>
          + 			</set-header>
          + 			<return-response response-variable-name="introspectionErrorResponse">
          + 				<set-status code="500" reason="Internal Server Error" />
          +           <set-body>{"title": "Proxy Error", "status": 401, "detail": "Unauthorized"}</set-body>
          +         </return-response>
          + 		</otherwise>
          + 	</choose>
            </fragment>
        EOT
        # (3 unchanged attributes hidden)
    }

  # module.apim_itn.azurerm_api_management_api_tag.wallet_admin will be created
  + resource "azurerm_api_management_api_tag" "wallet_admin" {
      + api_id = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/apis/io-p-wallet-admin-api;rev=1"
      + id     = (known after apply)
      + name   = "itwallet"
    }

  # module.apim_itn.azurerm_api_management_api_tag.wallet_app will be created
  + resource "azurerm_api_management_api_tag" "wallet_app" {
      + api_id = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/apis/io-p-wallet-app-api;rev=1"
      + id     = (known after apply)
      + name   = "itwallet"
    }

  # module.apim_itn.azurerm_api_management_api_tag.wallet_pdnd will be created
  + resource "azurerm_api_management_api_tag" "wallet_pdnd" {
      + api_id = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/apis/io-p-wallet-pdnd-api;rev=1"
      + id     = (known after apply)
      + name   = "itwallet"
    }

  # module.apim_itn.azurerm_api_management_api_tag.wallet_web will be created
  + resource "azurerm_api_management_api_tag" "wallet_web" {
      + api_id = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/apis/io-p-ioweb-wallet"
      + id     = (known after apply)
      + name   = "itwallet"
    }

  # module.storage_accounts.azurerm_storage_container.cosmos_01_backup will be destroyed
  # (because azurerm_storage_container.cosmos_01_backup is not in configuration)
  - resource "azurerm_storage_container" "cosmos_01_backup" {
      - container_access_type             = "private" -> null
      - default_encryption_scope          = "$account-encryption-key" -> null
      - encryption_scope_override_enabled = true -> null
      - has_immutability_policy           = false -> null
      - has_legal_hold                    = false -> null
      - id                                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01/blobServices/default/containers/cosmos-01-backup" -> null
      - metadata                          = {} -> null
      - name                              = "cosmos-01-backup" -> null
      - resource_manager_id               = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01/blobServices/default/containers/cosmos-01-backup" -> null
      - storage_account_id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01" -> null
        # (1 unchanged attribute hidden)
    }

  # module.storage_accounts.azurerm_storage_container.input will be destroyed
  # (because azurerm_storage_container.input is not in configuration)
  - resource "azurerm_storage_container" "input" {
      - container_access_type             = "private" -> null
      - default_encryption_scope          = "$account-encryption-key" -> null
      - encryption_scope_override_enabled = true -> null
      - has_immutability_policy           = false -> null
      - has_legal_hold                    = false -> null
      - id                                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01/blobServices/default/containers/input" -> null
      - metadata                          = {} -> null
      - name                              = "input" -> null
      - resource_manager_id               = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01/blobServices/default/containers/input" -> null
      - storage_account_id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01" -> null
        # (1 unchanged attribute hidden)
    }

  # module.storage_accounts.azurerm_storage_container.output will be destroyed
  # (because azurerm_storage_container.output is not in configuration)
  - resource "azurerm_storage_container" "output" {
      - container_access_type             = "private" -> null
      - default_encryption_scope          = "$account-encryption-key" -> null
      - encryption_scope_override_enabled = true -> null
      - has_immutability_policy           = false -> null
      - has_legal_hold                    = false -> null
      - id                                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01/blobServices/default/containers/output" -> null
      - metadata                          = {} -> null
      - name                              = "output" -> null
      - resource_manager_id               = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01/blobServices/default/containers/output" -> null
      - storage_account_id                = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Storage/storageAccounts/iopitnwalletst01" -> null
        # (1 unchanged attribute hidden)
    }

  # module.apim_itn.module.apim_v2_web_wallet_api.azurerm_api_management_api.this will be updated in-place
  ~ resource "azurerm_api_management_api" "this" {
      + description           = "Wallet APIs"
      ~ display_name          = "IO Wallet - IO Web API" -> "IO Web - Wallet"
        id                    = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-common-rg-01/providers/Microsoft.ApiManagement/service/io-p-itn-apim-01/apis/io-p-ioweb-wallet"
        name                  = "io-p-ioweb-wallet"
        # (15 unchanged attributes hidden)

      ~ import {
          ~ content_value  = jsonencode(
              ~ {
                  ~ info       = {
                      ~ title   = "IO Wallet - IO Web API" -> "IO Web - Wallet"
                        # (1 unchanged attribute hidden)
                    }
                    # (4 unchanged attributes hidden)
                }
            )
            # (1 unchanged attribute hidden)
        }

        # (1 unchanged block hidden)
    }

  # module.function_apps.module.function_app_user.azurerm_linux_function_app.this will be updated in-place
  ~ resource "azurerm_linux_function_app" "this" {
      ~ app_settings                                   = {
          + "AzureWebJobs.migrateWalletInstances.Disabled"                                                     = "0"
          + "CosmosAccountConnectionString"                                                                    = "CosmosAccountConnectionString"
            # (75 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Web/sites/io-p-itn-wallet-user-func-02"
        name                                           = "io-p-itn-wallet-user-func-02"
        tags                                           = {
            "CostCenter"                                     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"                                      = "Terraform"
            "Environment"                                    = "Prod"
            "ManagementTeam"                                 = "IO Wallet"
            "ModuleName"                                     = "azure_function_app"
            "ModuleSource"                                   = "DX"
            "ModuleVersion"                                  = "4.1.1"
            "Owner"                                          = "IO"
            "Source"                                         = "https://github.com/pagopa/io-wallet/blob/main/infra/resources/prod"
            "hidden-link: /app-insights-conn-string"         = "[REDACTED]"
            "hidden-link: /app-insights-instrumentation-key" = "[REDACTED]"
            "hidden-link: /app-insights-resource-id"         = "[REDACTED]"
        }
        # (33 unchanged attributes hidden)

      ~ sticky_settings {
          ~ app_setting_names       = [
                # (9 unchanged elements hidden)
                "AzureWebJobs.sendEmailOnWalletInstanceRevocation.Disabled",
              + "AzureWebJobs.migrateWalletInstances.Disabled",
            ]
            # (1 unchanged attribute hidden)
        }

        # (3 unchanged blocks hidden)
    }

  # module.function_apps.module.function_app_user.azurerm_linux_function_app_slot.this[0] will be updated in-place
  ~ resource "azurerm_linux_function_app_slot" "this" {
      ~ app_settings                                   = {
          + "AzureWebJobs.migrateWalletInstances.Disabled"                                                     = "1"
          + "CosmosAccountConnectionString"                                                                    = "CosmosAccountConnectionString"
            # (76 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Web/sites/io-p-itn-wallet-user-func-02/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Wallet"
            "ModuleName"     = "azure_function_app"
            "ModuleSource"   = "DX"
            "ModuleVersion"  = "4.1.1"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-wallet/blob/main/infra/resources/prod"
        }
        # (31 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.function_apps.module.function_app_user_uat.azurerm_linux_function_app.this will be updated in-place
  ~ resource "azurerm_linux_function_app" "this" {
      ~ app_settings                                   = {
          + "AzureWebJobs.migrateWalletInstances.Disabled"                                                     = "1"
          + "CosmosAccountConnectionString"                                                                    = "@Microsoft.KeyVault(VaultName=io-p-itn-wallet-kv-01;SecretName=CosmosAccountConnectionString)"
            # (75 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Web/sites/io-u-itn-wallet-user-func-01"
        name                                           = "io-u-itn-wallet-user-func-01"
        tags                                           = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Wallet"
            "ModuleName"     = "azure_function_app"
            "ModuleSource"   = "DX"
            "ModuleVersion"  = "4.1.1"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-wallet/blob/main/infra/resources/prod"
        }
        # (33 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.function_apps.module.function_app_user_uat.azurerm_linux_function_app_slot.this[0] will be updated in-place
  ~ resource "azurerm_linux_function_app_slot" "this" {
      ~ app_settings                                   = {
          + "AzureWebJobs.migrateWalletInstances.Disabled"                                                     = "1"
          + "CosmosAccountConnectionString"                                                                    = "@Microsoft.KeyVault(VaultName=io-p-itn-wallet-kv-01;SecretName=CosmosAccountConnectionString)"
            # (76 unchanged elements hidden)
        }
        id                                             = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-itn-wallet-rg-01/providers/Microsoft.Web/sites/io-u-itn-wallet-user-func-01/slots/staging"
        name                                           = "staging"
        tags                                           = {
            "CostCenter"     = "TS310 - PAGAMENTI & SERVIZI"
            "CreatedBy"      = "Terraform"
            "Environment"    = "Prod"
            "ManagementTeam" = "IO Wallet"
            "ModuleName"     = "azure_function_app"
            "ModuleSource"   = "DX"
            "ModuleVersion"  = "4.1.1"
            "Owner"          = "IO"
            "Source"         = "https://github.com/pagopa/io-wallet/blob/main/infra/resources/prod"
        }
        # (31 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

Plan: 4 to add, 11 to change, 3 to destroy.

Warning: Argument is deprecated

  with module.storage_accounts.azurerm_storage_queue.wallet-instance-creation-email-queue-01,
  on ../_modules/storage_accounts/storage_queue.tf line 3, in resource "azurerm_storage_queue" "wallet-instance-creation-email-queue-01":
   3:   storage_account_name = azurerm_storage_account.common.name

the `storage_account_name` property has been deprecated in favour of
`storage_account_id` and will be removed in version 5.0 of the Provider.

(and 3 more similar warnings elsewhere)

@silvicir silvicir merged commit ef3cb43 into master Jan 12, 2026
15 checks passed
@silvicir silvicir deleted the replace-storage-account-connection-string-with-managed-identities branch January 12, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants