New option: `--provider-version` to overwrite the provider version used for importing (other than using the bound version) (#376)

* New option: `--provider-version` to overwrite the provider version used for importing (other than using the bound version)

* Determine the provider version constraint under used if not specified

command_before_func.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/Azure/aztfexport/internal/meta"
 	"github.com/Azure/aztfexport/internal/utils"
+	"github.com/hashicorp/terraform-config-inspect/tfconfig"
 	"github.com/urfave/cli/v2"
 )
 
@@ -39,6 +40,11 @@ func commandBeforeFunc(fset *FlagSet) func(ctx *cli.Context) error {
 				return fmt.Errorf("`--module-path` must be used together with `--append`")
 			}
 		}
+		if fset.flagDevProvider {
+			if fset.flagProviderVersion != "" {
+				return fmt.Errorf("`--dev-provider` conflicts with `--provider-version`")
+			}
+		}
 
 		if flagLogLevel != "" {
 			if _, err := logLevel(flagLogLevel); err != nil {
@@ -142,6 +148,17 @@ The output directory is not empty. Please choose one of actions below:
 			}
 		}
 
+		// Determine any existing provider version constraint if not using a dev provider and the provider version not specified.
+		if !fset.flagDevProvider && fset.flagProviderVersion == "" {
+			module, err := tfconfig.LoadModule(fset.flagOutputDir)
+			if err != nil {
+				return fmt.Errorf("loading terraform config: %v", err)
+			}
+			if azurecfg, ok := module.RequiredProviders["azurerm"]; ok {
+				fset.flagProviderVersion = strings.Join(azurecfg.VersionConstraints, " ")
+			}
+		}
+
 		// Identify the subscription id, which comes from one of following (starts from the highest priority):
 		// - Command line option
 		// - Env variable: AZTFEXPORT_SUBSCRIPTION_ID

flag.go

@@ -16,6 +16,7 @@ type FlagSet struct {
 	flagOverwrite           bool
 	flagAppend              bool
 	flagDevProvider         bool
+	flagProviderVersion     string
 	flagBackendType         string
 	flagBackendConfig       cli.StringSlice
 	flagFullConfig          bool

internal/meta/base_meta.go

@@ -73,6 +73,7 @@ type baseMeta struct {
 	outputFileNames   config.OutputFileNames
 	tf                *tfexec.Terraform
 	resourceClient    *armresources.Client
+	providerVersion   string
 	devProvider       bool
 	backendType       string
 	backendConfig     []string
@@ -106,6 +107,9 @@ func NewBaseMeta(cfg config.CommonConfig) (*baseMeta, error) {
 	if cfg.Parallelism == 0 {
 		return nil, fmt.Errorf("Parallelism not set in the config")
 	}
+	if cfg.ProviderVersion != "" && cfg.DevProvider {
+		return nil, fmt.Errorf("ProviderVersion conflicts with DevProvider in the config")
+	}
 
 	// Determine the module directory and module address
 	var (
@@ -185,6 +189,10 @@ func NewBaseMeta(cfg config.CommonConfig) (*baseMeta, error) {
 		tc = telemetry.NewNullClient()
 	}
 
+	if !cfg.DevProvider && cfg.ProviderVersion == "" {
+		cfg.ProviderVersion = azurerm.ProviderSchemaInfo.Version
+	}
+
 	meta := &baseMeta{
 		subscriptionId:    cfg.SubscriptionId,
 		azureSDKCred:      cfg.AzureSDKCredential,
@@ -192,6 +200,7 @@ func NewBaseMeta(cfg config.CommonConfig) (*baseMeta, error) {
 		outdir:            cfg.OutputDir,
 		outputFileNames:   outputFileNames,
 		resourceClient:    resClient,
+		providerVersion:   cfg.ProviderVersion,
 		devProvider:       cfg.DevProvider,
 		backendType:       cfg.BackendType,
 		backendConfig:     cfg.BackendConfig,
@@ -560,7 +569,7 @@ func (meta *baseMeta) buildTerraformConfigForImportDir() string {
     }
   }
 }
-`, azurerm.ProviderSchemaInfo.Version)
+`, meta.providerVersion)
 }
 
 func (meta *baseMeta) buildTerraformConfig(backendType string) string {
@@ -580,7 +589,7 @@ func (meta *baseMeta) buildTerraformConfig(backendType string) string {
     }
   }
 }
-`, backendType, azurerm.ProviderSchemaInfo.Version)
+`, backendType, meta.providerVersion)
 }
 
 func (meta *baseMeta) buildProviderConfig() string {
@@ -641,6 +650,7 @@ func (meta *baseMeta) initProvider(ctx context.Context) error {
 	if diags.HasErrors() {
 		return diags.Err()
 	}
+
 	tfblock, err := utils.InspecTerraformBlock(meta.outdir)
 	if err != nil {
 		return err

internal/test/cases/case_key_vault_nested_items.go

@@ -58,6 +58,7 @@ resource "azurerm_key_vault" "test" {
       "Purge",
       "Recover",
       "Update",
+	  "GetRotationPolicy"
     ]
     secret_permissions = [
       "Set",

main.go

@@ -147,6 +147,12 @@ func main() {
 			Usage:       fmt.Sprintf("Use the local development AzureRM provider, instead of the pinned provider in v%s", azurerm.ProviderSchemaInfo.Version),
 			Destination: &flagset.flagDevProvider,
 		},
+		&cli.StringFlag{
+			Name:        "provider-version",
+			EnvVars:     []string{"AZTFEXPORT_PROVIDER_VERSION"},
+			Usage:       fmt.Sprintf("The azurerm provider version to use for importing (default: existing version constraints or %s)", azurerm.ProviderSchemaInfo.Version),
+			Destination: &flagset.flagProviderVersion,
+		},
 		&cli.StringFlag{
 			Name:        "backend-type",
 			EnvVars:     []string{"AZTFEXPORT_BACKEND_TYPE"},
@@ -386,6 +392,7 @@ func main() {
 							AzureSDKCredential:   cred,
 							AzureSDKClientOption: *clientOpt,
 							OutputDir:            flagset.flagOutputDir,
+							ProviderVersion:      flagset.flagProviderVersion,
 							DevProvider:          flagset.flagDevProvider,
 							ContinueOnError:      flagset.flagContinue,
 							BackendType:          flagset.flagBackendType,
@@ -437,6 +444,7 @@ func main() {
 							AzureSDKCredential:   cred,
 							AzureSDKClientOption: *clientOpt,
 							OutputDir:            flagset.flagOutputDir,
+							ProviderVersion:      flagset.flagProviderVersion,
 							DevProvider:          flagset.flagDevProvider,
 							ContinueOnError:      flagset.flagContinue,
 							BackendType:          flagset.flagBackendType,
@@ -487,6 +495,7 @@ func main() {
 							AzureSDKCredential:   cred,
 							AzureSDKClientOption: *clientOpt,
 							OutputDir:            flagset.flagOutputDir,
+							ProviderVersion:      flagset.flagProviderVersion,
 							DevProvider:          flagset.flagDevProvider,
 							ContinueOnError:      flagset.flagContinue,
 							BackendType:          flagset.flagBackendType,
@@ -538,6 +547,7 @@ func main() {
 							AzureSDKCredential:   cred,
 							AzureSDKClientOption: *clientOpt,
 							OutputDir:            flagset.flagOutputDir,
+							ProviderVersion:      flagset.flagProviderVersion,
 							DevProvider:          flagset.flagDevProvider,
 							ContinueOnError:      flagset.flagContinue,
 							BackendType:          flagset.flagBackendType,

pkg/config/config.go

@@ -27,6 +27,8 @@ type CommonConfig struct {
 	OutputDir string
 	// OutputFileNames specifies the output terraform filenames
 	OutputFileNames OutputFileNames
+	// ProviderVersion specifies the azurerm provider version used for importing. If this is not set, it will use `azurerm.ProviderSchemaInfo.Version` for importing in order to be consistent with tfadd.
+	ProviderVersion string
 	// DevProvider specifies whether users have configured the `dev_overrides` for the provider, which then uses a development provider built locally rather than using a version pinned provider from official Terraform registry.
 	// Meanwhile, it will also avoid running `terraform init` during `Init()` for the import directories to avoid caculating the provider hash and populating the lock file (See: https://developer.hashicorp.com/terraform/language/files/dependency-lock). Though the init for the output directory is still needed for initializing the backend.
 	DevProvider bool