Storage Transfer Service from Azure to GCS with Federated Identity.

[brycemosk26]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

The current google_storage_transfer_job forces you to utilize a SAS token when moving data from Azure -> GCS even though GCP exposes a method to do this via federated identities in the console. I'd like it so that the same tenant_id and client_id options are exposed in the terraform module.

New or Affected Resource(s)

google_storage_transfer_job

Potential Terraform Configuration

resource "google_storage_transfer_job" "azure-container-nightly-backup" {
  description = "Nightly backup of Azure container"
  project     = var.project

  transfer_spec {
    ....
    azure_blob_storage_data_source {
      storage_account = var.storage_account
      container = var.container
      path = var.path
      federated_identity {
         client_id = var.client_id
         tenant_id = var.tenant_id
      }
    }
    gcs_data_sink {
      bucket_name = google_storage_bucket.s3-backup-bucket.name
      path        = "foo/bar/"
    }
  }
  ....
}

References

No response

b/371607664

[SarahFrench]

Note from triage: The API docs currently only show SAS token as a method of authentication with Azure, but this PR looks like it's implementing federated identity config as described in these other docs.