Terraform ARM-Template 因 ID 不唯一而失败

Question

我使用以下 Terraform ARM 模板部署到 Azure Stack： ...

resource "azurestack_template_deployment" "nsg-rule1" {
  count = "${var.nsgr_map["nsg_sourceportranges"] == "" && var.nsgr_map["nsg_destinationportranges"] == "" && var.nsgr_map["nsg_sourceaddressprefixes"] == "" && var.nsgr_map["nsg_destinationaddressprefixes"] == "" ? 1 : 0}"
  name                = "${var.nsgr_map["nsg_rulename"]}"
  resource_group_name = "${var.nsgr_map["rsg_name"]}"

  template_body = <<DEPLOY
{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "networkSecurityGroupName": {
            "type": "String"
        },
        "networkSecurityGroupRuleName": {
            "type" : "String"
        }, 
        "protocol" : {
            "type" : "String"
        },
        "sourcePortRange": {
            "type" : "String"
        },
        "destinationPortRange": {
            "type" : "String"
        },
        "sourceAddressPrefix" : {
            "type" : "String"
        },
        "destinationAddressPrefix" : {
            "type" : "String"
        },
        "access" : {
            "type" : "String"
        },
        "priority" : {
            "type" : "String"
        },
        "direction" : {
            "type" : "String"
        },
        "sourcePortRanges" : {
            "type" : "String"
        },
        "destinationPortRanges" : {
            "type" : "String"
        },
        "sourceAddressPrefixes" : {
            "type" : "String"
        },
        "destinationAddressPrefixes" : {
            "type" : "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Network/networkSecurityGroups/securityRules",
            "apiVersion": "2017-10-01",
            "name": "[concat(parameters('networkSecurityGroupName'),'/',parameters('networkSecurityGroupRuleName'))]",
            "properties": {
                "protocol": "[parameters('protocol')]",
                "sourcePortRange": "[parameters('sourcePortRange')]",
                "destinationPortRange": "[parameters('destinationPortRange')]",
                "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
                "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
                "access": "[parameters('access')]",
                "priority": "[parameters('priority')]",
                "direction": "[parameters('direction')]",
                "sourcePortRanges": "[parameters('sourcePortRanges')]",
                "destinationPortRanges": "[parameters('destinationPortRanges')]",
                "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
                "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]"
            }
        }
    ]
}
DEPLOY

  # these key-value pairs are passed into the ARM Template's `parameters` block
  parameters = {
    networkSecurityGroupName = "${var.nsgr_map["nsg_name"]}"
    networkSecurityGroupRuleName = "${var.nsgr_map["nsg_rulename"]}"
    protocol = "${var.nsgr_map["nsg_protocol"]}"
    sourcePortRange = "${var.nsgr_map["nsg_source_portrange"]}"
    destinationPortRange = "${var.nsgr_map["nsg_destination_portrange"]}"
    sourceAddressPrefix ="${var.nsgr_map["nsg_sourceaddressprefix"]}"
    destinationAddressPrefix = "${var.nsgr_map["nsg_destinationaddressprefix"]}"
    access = "${var.nsgr_map["nsg_access"]}"
    priority = "${var.nsgr_map["nsg_priority"]}"
    direction = "${var.nsgr_map["nsg_direction"]}"
    sourcePortRanges = ""
    destinationPortRanges = ""
    sourceAddressPrefixes = ""
    destinationAddressPrefixes = ""
  }

  deployment_mode = "Incremental"
}

...

事实上，我想向 Azure Stack 上的现有网络安全组 (NSG) 添加一些 NSG 规则。问题是，如果我在同一资源组下部署具有相同名称的不同规则，部署将失败，因为 NSG 不是标识要创建的资源的 ID 的一部分。

换句话说，我有两个同名的规则 - 在资源组“Virtual_Network_1”下说“NSG_Rule_Open_VPN”，但对于两个不同的网络安全组“nsg_1”和“nsg_2”。然后部署失败并出现错误，因为 Terraform 两次部署相同的资源（但目标 NSG 不一样）

如果我查看 Azure Stack 上的 activity 协议，很明显 Terraform 不会使用 ID 中目标 NSG 的名称来创建资源：

"resourceId": "/subscriptions/yyyxxx/resourcegroups/RSG_99_VirtualNetwork_01/providers/Microsoft.Resources/deployments/NSR_out_TCP_allow_VMtoINTERNET-HTTPS",

它仅使用资源组名称“RSG_99_VirtualNetwork_01”和规则名称“NSR_out_TCP_allow_VMtoINTERNET-HTTPS”，但不使用 NSG 名称。

有没有办法避免这种情况。以便 Terraform 创建一个 resourceID，它也依赖于 NSG 名称？

Answer 1

发生这种情况是因为这是部署名称，而不是 NSG 规则名称。所以你需要更新这个位以包括 nsg-name 或一些计数器或随机的东西：

resource "azurestack_template_deployment" "nsg-rule1" {
  count = not_important_removed
  name                = "${var.nsgr_map["nsg_rulename"]}" # this bit needs to be updated
  resource_group_name = "${var.nsgr_map["rsg_name"]}"

Terraform ARM-Template 因 ID 不唯一而失败

Terraform ARM-Template fails because of not unique ID

terraform

azure-devops

arm-template

azure-stack