How do I migrate a Pulumi Azure resource to Azure-Nextgen?

Question

I'm trying to migrate the pulumi code for an Azure storage account (which was originally created with the legacy Azure provider) to the Azure-Nextgen provider. The Aliases property isn't working as expected. Is this possible, or am I missing something obvious?:

Original:

var storageAccount = new Account($"storage_{storageName}", new AccountArgs
    {
        Name = $"{storageName}",
        ResourceGroupName = resourceGroup.Name,
        AccountReplicationType = "LRS",
        AccountTier = "Standard",
        Location = resourceGroup.Location,
        IsHnsEnabled = true,
        MinTlsVersion = "TLS1_2"
    },
    new CustomResourceOptions()
    {
        Protect = true
    });

New:

var storageAccount = new StorageAccount($"storage_{storageName}",
    new StorageAccountArgs()
    {
        AccountName = $"{storageName}",
        Location = location,
        ResourceGroupName = resourceGroup.Name,
        Kind = Kind.StorageV2,
        AccessTier = AccessTier.Hot,
        Sku = new SkuArgs()
        {
            Name = SkuName.Standard_LRS
        },
        IsHnsEnabled = true,
        MinimumTlsVersion = MinimumTlsVersion.TLS1_2
    },
    new CustomResourceOptions()
    {
        Protect = true,
        Aliases =
        {
            new Alias
            {
                Urn = "urn:pulumi:myEnvironment::myStack::azure:storage/account:Account::storage_storageName"
            }
        }
    });

Pulumi preview in console:

azure:storage:Account (storage_storageName):
    error: Preview failed: refusing to delete protected resource 'urn:pulumi:myEnvironment::myStack::azure:storage/account:Account::storage_storageName'

score 3 · Accepted Answer · answered Feb 20 '21 at 08:55

Aliases don't work across providers. The shape of resources in the "classic" Azure provider differs from the next-gen native Azure provider, so the state is not compatible.

You would have to follow the following manual process:

Import the existing storage account as a new resource with NextGen

pulumi import azure-nextgen:storage/latest:StorageAccount storage /subscriptions/01234567-89ab-cdef-0123-456789abcdef/resourceGroups/my-rgca05c9f8/providers/Microsoft.Storage/storageAccounts/storagea791686

The command above would import the state and print out the code for you. Copy the code to your program.

Now, delete the old resource from your state (not from Azure)

pulumi state delete urn:pulumi:dev::ts::azure:storage/account:Account::storage

Remove the old resource from your Pulumi program.
Run pulumi up to make sure everything is working. You should see no changes.

There is a migration guide coming in the next couple of weeks, I'll update this answer with a link when it's out.

I tested this process with a resource with no dependencies and it works :) However, for a storage account with containers and other resources already provisioned inside of it, I get `error: This resource can't be safely deleted because the following resources depend on it:`. Is there any way to do this without deleting and then re-importing all of the containers? — UnknownBeef, Feb 21 '21 at 00:52
You need to update your program so that containers reference the newly imported storage account and run `pulumi up` to update the dependency graph in the state. Then you should be able to delete the old resource from the state. Alternatively, you can start with migrating your containers first, and then move the account. — Mikhail Shilkov, Feb 21 '21 at 16:28

How do I migrate a Pulumi Azure resource to Azure-Nextgen?

1 Answers1