在 Azure Function Terraform 脚本中指定用户分配的托管标识

Question

我正在使用 Terraform 脚本和 AzAPI 提供程序来部署 Azure Function（因为 AzureRM 尚不支持 Flex 使用计划）。该功能需要分配一个用户分配的托管标识。我的代码如下

resource "azapi_resource" "function_apps" {
  type  = "Microsoft.Web/sites@2024-04-01"
  schema_validation_enabled = false
  location = var.location
  name = var.FunctionAppName
  parent_id = var.resourcegroup
  body = {
    kind = "functionapp,linux",
    identity = {
      type = "UserAssigned"
      userAssignedIdentities = {

      }
    }
    ...

variable "myManagedIdentity" {
  type = string
  default = "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}"
}

根据此文档，它说

userAssignedIdentities

接受对象，它应该是引用托管身份资源ID的字典。我将其声明为

myManagedIdentity

变量，但我不知道如何将其放入

userAssignedIdentities

对象中。

上述文档中的示例没有多大帮助：

identity = {
    type = "string"
    userAssignedIdentities = {
      {customized property} = {
      }
    }
  }

谢谢。

Answer 1

它表示

userAssignedIdentities

接受对象，它应该是引用托管身份资源 ID 的字典。我将其声明为

myManagedIdentity

变量，但我不知道如何将其放入

userAssignedIdentities

对象中。

为了实现上述关于根据格式添加

userAssignedIdentities

对象的要求，请使用下面给出的 terraform 代码。我已经成功部署它，没有任何问题。

variable "usManagedIdentity" {
  type = string
  default = "/subscriptions/f7bxxx2832b014/resourceGroups/caronew/providers/Microsoft.ManagedIdentity/userAssignedIdentities/newuser"
}
terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
      version = "2.2.0"
    }
  }
}

provider "azapi" {
  # Configuration options
}
provider "azurerm"{
features{}
subscription_id = "f7xxxx014"
}
resource "azurerm_resource_group" "sample" {
  name     = "flex-function-rgnew"
  location = "East US"
}

resource "azurerm_service_plan" "sample" {
  name                = "flex-funsdction-plan"
  resource_group_name = azurerm_resource_group.sample.name
  location            = azurerm_resource_group.sample.location
  os_type             = "Linux"
  sku_name            = "FC1"
}
resource "azurerm_storage_account" "sample" {
  name                     = "flexfuncssdsda"
  resource_group_name      = azurerm_resource_group.sample.name
  location                 = azurerm_resource_group.sample.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_storage_container" "sample" {
  name                  = "my-flex-consumpeedtion-app"
  storage_account_name  = azurerm_storage_account.sample.name
  container_access_type = "private"
}
resource "azapi_resource" "sample" {
  type      = "Microsoft.Web/sites@2023-12-01"
  name      = "my-flex-consumption-appjh"
  location  = azurerm_resource_group.sample.location
  parent_id = azurerm_resource_group.sample.id

  body = {
    kind = "functionapp,linux"
    identity = {
      type = "UserAssigned"
      userAssignedIdentities = {
        "${var.usManagedIdentity}" = {}
      }
     }
    properties = {
      serverFarmId           = azurerm_service_plan.sample.id
      httpsOnly              = true
      functionAppConfig = {
        deployment = {
          storage = {
            type  = "blobContainer"
            value = "${azurerm_storage_account.sample.primary_blob_endpoint}${azurerm_storage_container.flex_function.name}"
            authentication = {
              type = "UserAssignedIdentity"
              userAssignedIdentityResourceId = "/subscriptions/f7bxxx2b014/resourceGroups/caronew/providers/Microsoft.ManagedIdentity/userAssignedIdentities/newuser"
            }
          }
        }
        runtime = {
          name    = "python"
          version = "3.11"
        }
        scaleAndConcurrency = {
          instanceMemoryMB     = 512
          maximumInstanceCount = 20
          triggers = {}
        }
      }

      siteConfig = {
        appSettings = [
          {
            name  = "FUNCTIONS_EXTENSION_VERSION"
            value = "~4"
          },
          
          {
            name  = "AzureWebJobsDashboard__accountName"
            value = azurerm_storage_account.sample.name
          },
          {
            name  = "AzureWebJobsStorage__accountName"
            value = azurerm_storage_account.sample.name
          }
        ]
      }
    }
  }
}

部署成功：

参考博客，使用 terraform 部署灵活的消费计划功能应用程序。