states.azurerm.storage.container

Azure Resource Manager (ARM) Blob Container State Module

New in version 2.0.0.

Changed in version 4.0.0.

maintainer:

<devops@eitr.tech>
configuration:

This module requires Azure Resource Manager credentials to be passed via acct. Note that the authentication parameters are case sensitive.

Required provider parameters:

if using username and password:
  • subscription_id
  • username
  • password
if using a service principal:
  • subscription_id
  • tenant
  • client_id
  • secret

Optional provider parameters:

cloud_environment: Used to point the cloud driver to different API endpoints, such as Azure GovCloud. Possible values:

  • AZURE_PUBLIC_CLOUD (default)
  • AZURE_CHINA_CLOUD
  • AZURE_US_GOV_CLOUD
  • AZURE_GERMAN_CLOUD

Example acct setup for Azure Resource Manager authentication:

azurerm:
    default:
        subscription_id: 3287abc8-f98a-c678-3bde-326766fd3617
        tenant: ABCDEFAB-1234-ABCD-1234-ABCDEFABCDEF
        client_id: ABCDEFAB-1234-ABCD-1234-ABCDEFABCDEF
        secret: XXXXXXXXXXXXXXXXXXXXXXXX
        cloud_environment: AZURE_PUBLIC_CLOUD
    user_pass_auth:
        subscription_id: 3287abc8-f98a-c678-3bde-326766fd3617
        username: fletch
        password: 123pass

The authentication parameters can also be passed as a dictionary of keyword arguments to the connection_auth parameter of each state, but this is not preferred and could be deprecated in the future.
idem_azurerm.states.azurerm.storage.container.absent(hub, ctx, name, account, resource_group, connection_auth=None, **kwargs)

New in version 2.0.0.

Ensures a specified blob container does not exist.

Parameters:
  • name – The name of the blob container within the specified storage account. Blob container names must be between 3 and 63 characters in length and use numbers, lower-case letters and dash (-) only. Every dash (-) character must be immediately preceded and followed by a letter or number.
  • account – The name of the storage account within the specified resource group. Storage account names must be between 3 and 24 characters in length and use numbers and lower-case letters only.
  • resource_group – The name of the resource group within the user’s subscription. The name is case insensitive.
  • connection_auth – A dict with subscription and authentication parameters to be used in connecting to the Azure Resource Manager API.

Example usage:

Ensure blob container is absent:
    azurerm.storage.container.absent:
        - name: my_container
        - account: my_account
        - resource_group: my_rg
idem_azurerm.states.azurerm.storage.container.immutability_policy_absent(hub, ctx, name, account, resource_group, if_match=None, connection_auth=None, **kwargs)

New in version 2.0.0.

Ensures that the immutability policy of a specified blob container does not exist.

Parameters:
  • name – The name of the blob container within the specified storage account. Blob container names must be between 3 and 63 characters in length and use numbers, lower-case letters and dash (-) only. Every dash (-) character must be immediately preceded and followed by a letter or number.
  • account – The name of the storage account within the specified resource group. Storage account names must be between 3 and 24 characters in length and use numbers and lower-case letters only.
  • resource_group – The name of the resource group within the user’s subscription. The name is case insensitive.
  • if_match – The entity state (ETag) version of the immutability policy to update. It is important to note that the ETag must be passed as a string that includes double quotes. For example, ‘“8d7b4bb4d393b8c”’ is a valid string to pass as the if_match parameter, but “8d7b4bb4d393b8c” is not. Defaults to None.
  • connection_auth – A dict with subscription and authentication parameters to be used in connecting to the Azure Resource Manager API.

Example usage:

Ensure immutability policy is absent:
    azurerm.storage.container.absent:
        - name: my_container
        - account: my_account
        - resource_group: my_rg
        - if_match: '"my_etag"'
idem_azurerm.states.azurerm.storage.container.immutability_policy_present(hub, ctx, name, account, resource_group, immutability_period, if_match=None, protected_append_writes=None, connection_auth=None, **kwargs)

New in version 2.0.0.

Changed in version 4.0.0.

Ensures that the immutability policy of a specified blob container exists. ETag in If-Match is honored if given but
not required for this operation.The container must be of account kind ‘StorageV2’ in order to utilize an immutability policy.
Parameters:
  • name – The name of the blob container within the specified storage account. Blob container names must be between 3 and 63 characters in length and use numbers, lower-case letters and dash (-) only. Every dash (-) character must be immediately preceded and followed by a letter or number.
  • account – The name of the storage account within the specified resource group. Storage account names must be between 3 and 24 characters in length and use numbers and lower-case letters only.
  • resource_group – The name of the resource group within the user’s subscription. The name is case insensitive.
  • immutability_period – The immutability period for the blobs in the container since the policy creation (in days).
  • if_match – The entity state (ETag) version of the immutability policy to update. A value of “*” can be used to apply the operation only if the immutability policy already exists. If omitted, this operation will always be applied. It is important to note that any ETag must be passed as a string that includes double quotes. For example, ‘“8d7b4bb4d393b8c”’ is a valid string to pass as the if_match parameter, but “8d7b4bb4d393b8c” is not. Defaults to None.
  • protected_append_writes – A boolean value specifying whether new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property can only be changed for unlocked time-based retention policies.
  • connection_auth – A dict with subscription and authentication parameters to be used in connecting to the Azure Resource Manager API.

Example usage:

Ensure immutability policy exists:
    azurerm.storage.container.immutability_policy_present:
        - name: my_container
        - account: my_account
        - resource_group: my_rg
        - immutability_period: 10
idem_azurerm.states.azurerm.storage.container.present(hub, ctx, name, account, resource_group, public_access, default_encryption_scope=None, deny_encryption_scope_override=None, metadata=None, connection_auth=None, **kwargs)

New in version 2.0.0.

Changed in version 4.0.0.

Ensure a blob container exists.

Parameters:
  • name – The name of the blob container within the specified storage account. Blob container names must be between 3 and 63 characters in length and use numbers, lower-case letters and dash (-) only. Every dash (-) character must be immediately preceded and followed by a letter or number.
  • account – The name of the storage account within the specified resource group. Storage account names must be between 3 and 24 characters in length and use numbers and lower-case letters only.
  • resource_group – The name of the resource group within the user’s subscription. The name is case insensitive.
  • public_access – Specifies whether data in the container may be accessed publicly and the level of access. Possible values include: “Container”, “Blob”, “None”.
  • default_encryption_scope – Set the default encryption scope for the container to use for all writes.
  • deny_encryption_scope_override – A boolean flag representing whether or not to block the override of the encryption scope from the container default.
  • metadata – A dictionary of name-value pairs to associate with the container as metadata.
  • connection_auth – A dict with subscription and authentication parameters to be used in connecting to the Azure Resource Manager API.

Example usage:

Ensure blob container exists:
    azurerm.storage.container.present:
        - name: my_container
        - account: my_account
        - resource_group: my_rg
        - public_access: 'Blob'