chore: azure depdnency outputs reading

Author: denis256

internal/remotestate/backend/azurerm/backend.go

@@ -160,7 +160,11 @@ func NewStateBlobClient(
 
 	keyed, err := sharedKeyConfig(ctx, cfg)
 	if err != nil {
-		return nil, fmt.Errorf("resolving storage account key for azurerm state access: %w", err)
+		// ErrStateClientSetup marks this as a setup failure: the ARM key lookup answers
+		// 404 for a wrong resource group, account, or subscription, and a caller must not
+		// read that as "the state blob does not exist yet".
+		return nil, fmt.Errorf("%w: resolving storage account key for azurerm state access: %w",
+			ErrStateClientSetup, err)
 	}
 
 	l.Debugf("%s: using shared-key authorization for direct state access", BackendName)

internal/remotestate/backend/azurerm/errors.go

@@ -59,6 +59,11 @@ func (e *CrossCloudMigrationError) Error() string {
 // always supplies.
 var ErrBackendOptionsRequired = errors.New("backend options are required")
 
+// ErrStateClientSetup marks a failure to build the state client, as opposed to the
+// state blob being absent. The ARM key lookup answers 404 for a wrong resource
+// group, account, or subscription, which callers must not read as "not applied yet".
+var ErrStateClientSetup = errors.New("building azurerm state client")
+
 // ErrAzureBackendExperimentRequired is returned when an azurerm backend
 // lifecycle operation is attempted without the `azure-backend` experiment
 // enabled. Match with errors.Is.

pkg/config/dependency.go

@@ -1115,6 +1115,14 @@ func isAwsS3StateMissing(err error) bool {
 // isRemoteStateMissing reports whether err means a supported backend's state object or its
 // containing bucket/container does not exist yet.
 func isRemoteStateMissing(err error) bool {
+	// A failure to build the client is not an absent state. The azurerm key lookup
+	// calls ARM, which answers 404 for a wrong resource group, account, or
+	// subscription; treating that as "not applied yet" would swap mock outputs into
+	// a run whose state actually exists.
+	if errors.Is(err, azurermbackend.ErrStateClientSetup) {
+		return false
+	}
+
 	return isAwsS3StateMissing(err) ||
 		errors.Is(err, storage.ErrObjectNotExist) ||
 		errors.Is(err, storage.ErrBucketNotExist) ||

pkg/config/dependency_internal_test.go

@@ -1166,6 +1166,21 @@ func TestIsRemoteStateMissing(t *testing.T) {
 				ErrorCode:  "AuthorizationFailure",
 			}),
 		},
+		// The azurerm key lookup calls ARM, which answers 404 for a wrong resource
+		// group, account, or subscription. Reading that as an absent state would swap
+		// mock outputs into a run whose state actually exists.
+		{
+			name: "Azure ARM resource group not found is a setup failure",
+			err: fmt.Errorf("%w: resolving storage account key: %w",
+				azurermbackend.ErrStateClientSetup,
+				&azcore.ResponseError{StatusCode: http.StatusNotFound, ErrorCode: "ResourceGroupNotFound"}),
+		},
+		{
+			name: "Azure ARM subscription not found is a setup failure",
+			err: fmt.Errorf("%w: resolving storage account key: %w",
+				azurermbackend.ErrStateClientSetup,
+				&azcore.ResponseError{StatusCode: http.StatusNotFound, ErrorCode: "SubscriptionNotFound"}),
+		},
 	}
 
 	for _, testCase := range testCases {

test/fixtures/output-from-remote-state-gcs/root.hcl

@@ -1,11 +1,6 @@
 remote_state {
   backend = "gcs"
 
-  generate = {
-    path      = "backend.tf"
-    if_exists = "overwrite"
-  }
-
   config = {
     project  = "__FILL_IN_PROJECT__"
     location = "__FILL_IN_LOCATION__"

test/integration_azure_test.go

@@ -50,7 +50,7 @@ func TestAzureDependencyFetchOutputFromState(t *testing.T) {
 	producerPath := filepath.Join(rootPath, "producer")
 	consumerPath := filepath.Join(rootPath, "consumer")
 	consumerPlan := "terragrunt run plan --backend-bootstrap --experiment azure-backend " +
-		"--dependency-fetch-output-from-state --non-interactive --working-dir " + consumerPath
+		"--dependency-fetch-output-from-state --non-interactive --log-level debug --working-dir " + consumerPath
 
 	stdout, _, err := helpers.RunTerragruntCommandWithOutput(t, consumerPlan)
 	require.NoError(t, err)
@@ -64,10 +64,15 @@ func TestAzureDependencyFetchOutputFromState(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	stdout, _, err = helpers.RunTerragruntCommandWithOutput(t, consumerPlan)
+	stdout, stderr, err := helpers.RunTerragruntCommandWithOutput(t, consumerPlan)
 	require.NoError(t, err)
 	assert.Contains(t, stdout, "from-azure-state")
 	assert.NotContains(t, stdout, "mock-azure-value")
+
+	// The value alone does not prove the optimization ran: `tofu output` returns it
+	// too. Only the direct reader logs this, naming the blob it read.
+	assert.Contains(t, stderr+stdout, "Fetching outputs directly from azurerm://",
+		"outputs must come from the state blob, not from running tofu output")
 }
 
 // Environment variables the live tests read, most specific first. The ARM_* /

test/integration_gcp_test.go

@@ -65,7 +65,7 @@ func TestGcpDependencyFetchOutputFromState(t *testing.T) {
 	producerPath := filepath.Join(rootPath, "producer")
 	consumerPath := filepath.Join(rootPath, "consumer")
 	consumerPlan := "terragrunt run plan --backend-bootstrap --dependency-fetch-output-from-state " +
-		"--non-interactive --working-dir " + consumerPath
+		"--non-interactive --log-level debug --working-dir " + consumerPath
 
 	stdout, _, err := helpers.RunTerragruntCommandWithOutput(t, consumerPlan)
 	require.NoError(t, err)
@@ -79,10 +79,15 @@ func TestGcpDependencyFetchOutputFromState(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	stdout, _, err = helpers.RunTerragruntCommandWithOutput(t, consumerPlan)
+	stdout, stderr, err := helpers.RunTerragruntCommandWithOutput(t, consumerPlan)
 	require.NoError(t, err)
 	assert.Contains(t, stdout, "from-gcs-state")
 	assert.NotContains(t, stdout, "mock-gcs-value")
+
+	// The value alone does not prove the optimization ran: `tofu output` returns it
+	// too. Only the direct reader logs this, naming the object it read.
+	assert.Contains(t, stderr+stdout, "Fetching outputs directly from gs://",
+		"outputs must come from the state object, not from running tofu output")
 }
 
 func TestGcpBootstrapBackend(t *testing.T) {