feat: Add AzureBlobStorage connection type support for stream connections by jwongmongodb · Pull Request #4357 · mongodb/terraform-provider-mongodbatlas

jwongmongodb · 2026-03-31T18:52:45Z

Description

Adds support for AzureBlobStorage as a new stream connection type in mongodbatlas_stream_connection resource and data sources.

Link to any related issue(s): CLOUDP-383606

Type of change:

New feature (non-breaking change which adds functionality). Please, add the "enhancement" label to the PR. A migration guide must be created or updated if the new feature will go in a major version.
This change requires a documentation update

Required Checklist:

I have signed the MongoDB CLA
I have read the contributing guides
I have checked that this change does not generate any credentials and that they are NOT accidentally logged anywhere.
I have added tests that prove my fix is effective or that my feature works per HashiCorp requirements
I have added any necessary documentation (if appropriate)
I have run make fix and verified my code
If changes include deprecations or removals I have added appropriate changelog entries.
If changes include removal or addition of 3rd party GitHub actions, I updated our internal document. Reach out to the APIx Integration slack channel to get access to the internal document.

Copilot

Pull request overview

Adds AzureBlobStorage as a supported stream connection type for the mongodbatlas_stream_connection Terraform resource and related data sources, including schema/model mapping, acceptance tests, and documentation/examples updates.

Changes:

Extend stream connection schemas/models (codegen + provider) to include an azure configuration block and AzureBlobStorage type handling.
Update request/response mapping to support Azure-specific fields and publicPrivateNetworking mapping for networking.
Add acceptance tests, docs, examples, and changelog entries for the new connection type.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
tools/codegen/models/stream_connection_api.yaml	Adds AzureBlobStorage type + azure fields and allows networking for the new type in codegen model.
internal/testutil/acc/pre_check.go	Adds acceptance test pre-check for Azure Blob Storage env vars.
internal/serviceapi/streamconnectionapi/resource_schema.go	Generated schema updated to include `azure` and allow it for `AzureBlobStorage`.
internal/service/streamconnection/resource_stream_connection.go	Adds connection-type constants and Azure object model/type definitions.
internal/service/streamconnection/resource_schema.go	Adds `AzureBlobStorage` schema block and expands `type` validation list.
internal/service/streamconnection/model_stream_connection.go	Maps Azure fields to/from SDK and routes networking to `PublicPrivateNetworking` for Azure.
internal/service/streamconnection/resource_stream_connection_test.go	Adds AzureBlobStorage acceptance test and helpers.
internal/service/streamconnection/model_stream_connection_test.go	Adds unit test coverage for Azure SDK<->TF mapping and TF->SDK request creation.
examples/mongodbatlas_stream_connection/*	Adds example configuration and variables for Azure Blob Storage connection.
docs/resources/stream_connection.md	Adds Azure example and documents Azure arguments/type.
docs/data-sources/stream_connections.md	Documents Azure in stream connections data source.
docs/data-sources/stream_connection.md	Documents Azure in stream connection data source.
.changelog/4356.txt	Adds release notes for AzureBlobStorage support and PRIVATE_LINK networking.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-04-02T03:00:20Z

APIx bot: a message has been sent to Docs Slack channel

augmentcode · 2026-04-02T03:06:09Z

🤖 Augment PR Summary

Summary: Adds first-class support for AzureBlobStorage as a stream connection type in the Terraform provider.

Changes:

Extends the stream connection resource/data source docs to include Azure Blob Storage and its attributes
Adds an azure nested block to the framework-based mongodbatlas_stream_connection schema and maps it to Atlas SDK request/response models
Updates networking handling to support PUBLIC/PRIVATE_LINK for Azure Blob Storage via the API’s public/private networking field
Adds type validation for the stream connection type attribute
Adds unit test coverage for AzureBlobStorage model conversions and an acceptance test for the new connection type
Updates acceptance-test runner workflow to pass required Azure environment variables
Adds changelog entries documenting the new connection type and networking access support

Technical Notes: Azure networking uses the public/private networking API shape while still exposing a consistent Terraform networking block in the framework resource.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.

lizo-mdb

LGTM with a few small suggestions!

maastha · 2026-04-02T19:39:12Z

 	"strings"
 	"testing"

+	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"


Suggested change

"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"

"github.com/hashicorp/terraform-plugin-testing/helper/acctest"

maastha · 2026-04-02T19:40:33Z

+					"storage_account_name": schema.StringAttribute{
+						Required: true,
+					},
+					"region": schema.StringAttribute{


do we need a UseStateForUnknown plan modifier? How does the plan show if anything is changed in this object?

since region is computed each time the storage account changes, UseStateForUnknown may cause errors if the planned value doesn't match what the API returns

maastha · 2026-04-02T19:41:27Z

+					"storage_account_name": schema.StringAttribute{
+						Required: true,
+					},
+					"region": schema.StringAttribute{


why is this optional/computed?

it's in the API spec as optional, so it's computed if users don't supply a value. In the UI there's not even a field for users to add it so it would only be something that the api/sdk/tf supports

marcosuma · 2026-04-03T06:35:30Z

+				},
+			}
+		default:
+			return nil, diag.Diagnostics{diag.NewErrorDiagnostic(


one nit but I think right now we're never erroring, right? no matter what's the type we assume is StreamsKafkaNetworking

right that's the existing behavior, and PublicPrivateNetworking was introduced in the last SDK update (so as of yet will only be used for Azure blob storage and GCP pubsub)

…ions CLOUDP-383606

EspenAlbert · 2026-04-06T09:12:35Z

+}
+
+variable "azure_region" {
+  description = "Azure region where you locate the storage account"


What format is used? The atlas US_EAST_1 or azure style eastus1?

azure style eastus1

Can you add that example to the docs? (Common source of confusion)

EspenAlbert

Looks quite good. Would maybe consider an example to demonstrate the privatelink functionality.
Main uncertainty I have is about the stream_connection not using role_id, seems weird to specify the service_principal_id twice

EspenAlbert · 2026-04-06T09:23:22Z

+		 	connection_name = %[10]q
+		 	type = "AzureBlobStorage"
+			azure = {
+				service_principal_id = %[4]q


This setup confuses me a bit.
Why is the azure not referencing the mongodbatlas_cloud_provider_access_setup.azure_setup.role_id?

Seems a bit inconsistent that the atlas resource require azure service_principal_id?

the way the API is set up, the input is service_principal_id and then role_id is computed

IMO: This is a bad experience. role_id is what should be configured, but understand it is a big ask to change the API :/

I think it has to do with the way the UI is set up, where users will configure their Azure integration and get a service principal ID, and then on the streams connection manager page they choose between their service principal IDs (since there may be multiple), and role ID is abstracted away

lantoli · 2026-04-06T09:48:35Z

 ## Attributes Reference

-* `type` - Type of connection. Can be `AWSLambda`, `Cluster`, `GCPPubSub`, `Https`, `Kafka`, `Sample`, or `SchemaRegistry`.
+* `type` - Type of connection. Can be `AWSKinesisDataStreams`, `AWSLambda`, `AzureBlobStorage`, `Cluster`, `GCPPubSub`, `Https`, `Kafka`, `S3`, `Sample`, or `SchemaRegistry`.


looks like some types were missing that are not related to this PR change, consider either doing it in a different PR or at least mention it in this PR description. same for the other files

removed from this PR

lantoli · 2026-04-06T09:53:33Z

 ### AWS
 * `role_arn` - Amazon Resource Name (ARN) that identifies the Amazon Web Services (AWS) Identity and Access Management (IAM) role that MongoDB Cloud assumes when it accesses resources in your AWS account.

+* `service_principal_id` - (Required) UUID that identifies the Azure Service Principal used to access the Azure Blob Storage account.


new 3 attrs should be in Azure section instead of AWS section

lantoli · 2026-04-06T09:54:12Z

 * `security` - Properties for the secure transport connection to Kafka. For SASL_SSL, this can include the trusted certificate to use. See [security](#security).
 * `networking` - Networking Access Type can either be `PUBLIC` (default) or `VPC`. See [networking](#networking).

+If `type` is `AzureBlobStorage` the the configuration defines the following additional attributes:


Suggested change

If `type` is `AzureBlobStorage` the the configuration defines the following additional attributes:

If `type` is `AzureBlobStorage` the configuration defines the following additional attributes:

lantoli · 2026-04-06T09:55:53Z

+	resourceChecks := []resource.TestCheckFunc{
+		checkStreamConnectionExists(),
+		resource.TestCheckResourceAttrSet(resourceName, "project_id"),
+		resource.TestCheckResourceAttr(resourceName, "workspace_name", workspaceName),


we're in TPF so no need to check customer-provided values, only useful to check Computed attributes

lantoli · 2026-04-06T10:10:23Z

 * `instance_name` - (Optional, Deprecated) Label that identifies the stream processing workspace. Use `workspace_name` instead; this attribute will be removed in a future major version.
 * `connection_name` - (Required) Label that identifies the stream connection. In the case of the Sample type, this is the name of the sample source.
-* `type` - (Required) Type of connection. Can be `AWSLambda`, `Cluster`, `GCPPubSub`, `Https`, `Kafka`, `Sample`, or `SchemaRegistry`.
+* `type` - (Required) Type of connection. Can be `AWSKinesisDataStreams`, `AWSLambda`, `AzureBlobStorage`, `Cluster`, `GCPPubSub`, `Https`, `Kafka`, `S3`, `Sample`, or `SchemaRegistry`.


nit: i guess it's because of the Atlas API, there is a naming inconsistency, prefixing with AWS/Azure sometimes (e.g., AWSKinesisDataStreams, AWSLambda, AzureBlobStorage) but not with S3

yeah we had a discussion about this on the streams team since S3 can be used by other non-AWS providers too

christineschen · 2026-04-06T15:01:10Z

@EspenAlbert the private link support is done in a separate PR that I just put up for review here: #4366

I can remove the line from the changelog in this PR if that makes it confusing

EspenAlbert · 2026-04-06T16:03:56Z


 	resource.ParallelTest(t, resource.TestCase{
-		PreCheck:                 func() { acc.PreCheckBasic(t); acc.PreCheckLogIntegrationEnvAzure(t) },
+		PreCheck:                 func() { acc.PreCheckAzureEnvWithServicePrincipal(t) },


notice how

terraform-provider-mongodbatlas/internal/serviceapi/logintegration/resource_test.go

Lines 691 to 692 in 12d6a4e

func azureStorageContainerConfig(projectID string, config *azureConfig) string {

return fmt.Sprintf(`

uses the exact same storage account setup.
Can we refactor into acc package? see code/provider/internal/testutil/acc/stream_instance.go for existing example

EspenAlbert

Thank you for addressing the comments!

EspenAlbert · 2026-04-06T16:08:45Z

@EspenAlbert the private link support is done in a separate PR that I just put up for review here: #4366

I can remove the line from the changelog in this PR if that makes it confusing

Yes, that would be great 👍

lantoli

thanks, LGTM once all comments are addressed and new acceptance test passes in PR checks

Copilot AI review requested due to automatic review settings March 31, 2026 18:52

github-actions Bot added the enhancement label Mar 31, 2026

Copilot started reviewing on behalf of jwongmongodb March 31, 2026 18:53 View session

jwongmongodb force-pushed the CLOUDP-383606_azure_blob_storage_streams branch from 0fed114 to 7c789c6 Compare March 31, 2026 18:54

Copilot AI reviewed Mar 31, 2026

View reviewed changes

christineschen force-pushed the CLOUDP-383606_azure_blob_storage_streams branch 2 times, most recently from 87e352b to 957e89c Compare April 1, 2026 20:04

christineschen marked this pull request as ready for review April 2, 2026 03:00

christineschen requested review from a team as code owners April 2, 2026 03:00

augmentcode Bot reviewed Apr 2, 2026

View reviewed changes

Comment thread internal/service/streamconnection/resource_stream_connection_test.go Outdated

Comment thread internal/serviceapi/streamconnectionapi/resource_schema.go Outdated

Comment thread tools/codegen/models/stream_connection_api.yaml Outdated

lizo-mdb approved these changes Apr 2, 2026

View reviewed changes

maastha reviewed Apr 2, 2026

View reviewed changes

christineschen force-pushed the CLOUDP-383606_azure_blob_storage_streams branch from 1a726f0 to f423200 Compare April 2, 2026 22:23

christineschen requested a review from maastha April 2, 2026 22:23

marcosuma reviewed Apr 3, 2026

View reviewed changes

christineschen requested a review from marcosuma April 3, 2026 15:03

jwongmongodb and others added 7 commits April 3, 2026 12:45

feat: Add AzureBlobStorage connection type support for stream connect…

ce1366c

…ions CLOUDP-383606

set up azure storage account in acceptance test

a3257f3

copilot comments

cf9b2a8

add acc test secrets

7e95dd2

fix networking and storage account name

96bd510

docs updates

32eeede

fix import and adjust networking logic

1040cec

christineschen force-pushed the CLOUDP-383606_azure_blob_storage_streams branch from f423200 to 1040cec Compare April 3, 2026 16:47

fix funlen error

4e9de5d

EspenAlbert reviewed Apr 6, 2026

View reviewed changes

Comment thread internal/service/streamconnection/resource_schema.go Outdated

EspenAlbert reviewed Apr 6, 2026

View reviewed changes

Comment thread internal/service/streamconnection/resource_stream_connection_test.go Outdated

EspenAlbert reviewed Apr 6, 2026

View reviewed changes

lantoli reviewed Apr 6, 2026

View reviewed changes

clean up test config and precheck, address other comments

12d6a4e

christineschen requested review from EspenAlbert and lantoli April 6, 2026 14:58

EspenAlbert reviewed Apr 6, 2026

View reviewed changes

EspenAlbert approved these changes Apr 6, 2026

View reviewed changes

christineschen added 2 commits April 6, 2026 12:14

update docs with azure region and remove private link from changelog

1ac00dc

refactor storage account setup

b269db0

lantoli approved these changes Apr 6, 2026

View reviewed changes

christineschen merged commit df626fe into master Apr 6, 2026
46 of 47 checks passed

christineschen deleted the CLOUDP-383606_azure_blob_storage_streams branch April 6, 2026 20:14

svc-apix-Bot added a commit that referenced this pull request Apr 6, 2026

chore: Updates CHANGELOG.md for #4357

3a47c64

	"github.com/hashicorp/terraform-plugin-sdk/helper/acctest"
	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"

	If `type` is `AzureBlobStorage` the the configuration defines the following additional attributes:
	If `type` is `AzureBlobStorage` the configuration defines the following additional attributes:

	func azureStorageContainerConfig(projectID string, config *azureConfig) string {
	return fmt.Sprintf(`

Conversation

jwongmongodb commented Mar 31, 2026 • edited by christineschen Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change:

Required Checklist:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 2, 2026

Uh oh!

augmentcode Bot commented Apr 2, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lizo-mdb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

EspenAlbert left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lantoli Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

jwongmongodb commented Mar 31, 2026 •

edited by christineschen

Loading

lantoli Apr 6, 2026 •

edited

Loading

EspenAlbert Apr 6, 2026 •

edited

Loading

lantoli left a comment •

edited

Loading