如何在 Terraform 中的 azurerm_storage_account 或 azurerm_storage_account_network_rules 中传递多子网 ID

Question

我正在尝试使用 Terraform 在 Azure 中创建存储帐户，但似乎无法将 virtual_network_subnet_ids 动态传递到 network_rules 块或 azurerm_storage_account_network_rules 资源块中。 它似乎不喜欢将动态块添加到 azurerm_storage_account 中，声明“不允许超过 1 个“network_rules”块”。 我有多个存储帐户，并尝试通过传递带有子网名称的变量来划分子网。

terraform.tfvars

 sa = {
  sta1 = {
    name                    = "storageacct001"
    resource_group_name     = "rg1"
    account_kind            = "StorageV2"
    account_tier            = "Standard"
    replication_type        = "LRS"
    access_tier             = "Hot"
    enable_hierarchical_ns  = false
    enable_sftp             = false
    enable_large_file_share = false
    billingTag              = "billing_project"
    systemTag               = "Azure"
    componentTag            = "Database Backup Files"
    subnets = [
      "subnet1",
      "subnet2",
      "subnet3",
      "subnet4",
      "subnet5",
      "subnet6"
    ]
  }
}

仅使用存储帐户资源块而不调用模块，我似乎每次构建此模块时都会遇到错误。

azurerm_storage_account

resource "azurerm_storage_account" "sa" {
  name                     = var.sa.sta1.name
  ""
  ""
  ""

  network_rules {
    default_action = var.default_network_rule
    bypass         = var.traffic_bypass
    ip_rules       = var.aamva_vpn_ip_address
    dynamic "virtual_network_subnet_ids" {
      for_each = var.sa.sta1.subnets
      content {
        virtual_network_subnet_ids = [data.azurerm_subnet.vnet-subnets[virtual_network_subnet_ids.value].id]
      }
    }
  }
}

Error: Unsupported block type
│
│   on sa.tf line 34, in resource "azurerm_storage_account" "sa":
│   34:     dynamic "virtual_network_subnet_ids" {
│
│ Blocks of type "virtual_network_subnet_ids" are not expected here.



resource "azurerm_storage_account" "sa" {
      name                     = var.sa.sta1.name
      ""
      ""
      ""
 dynamic "network_rules" {
    for_each = var.sa.sta1.subnets 
    content {
    default_action = var.default_network_rule
    bypass         = var.traffic_bypass
    ip_rules       = var.aamva_vpn_ip_address
    virtual_network_subnet_ids = [data.azurerm_subnet.vnet-subnets[network_rules.value].id]
    }
  }

│ Error: Too many network_rules blocks
│
│   on sa.tf line 32, in resource "azurerm_storage_account" "sa":
│   32:     content {
│
│ No more than 1 "network_rules" blocks are allowed

azurerm_storage_account_network_rules

 resource "azurerm_storage_account_network_rules" "sa" {
      storage_account_id = azurerm_storage_account.sa.id
    ""
    ""
    ""
    dynamic "virtual_network_subnet_ids" {
        for_each = var.sa.sta1.subnets
        content {
          virtual_network_subnet_ids = [data.azurerm_subnet.vnet-subnets[virtual_network_subnet_ids.value].id]
        }
      }
    }
    │ Error: Unsupported block type
    │
    │   on sa.tf line 43, in resource "azurerm_storage_account_network_rules" "sa":
    │   43:   dynamic "virtual_network_subnet_ids" {
    │
    │ Blocks of type "virtual_network_subnet_ids" are not expected here.

resource "azurerm_storage_account" "sa" {
          name                     = var.sa.sta1.name
          ""
          ""
          ""
 network_rules {
    default_action = var.default_network_rule
    bypass         = var.traffic_bypass
    ip_rules       = var.aamva_vpn_ip_address
  }

  lifecycle {
    ignore_changes = [
      network_rules
    ]
  }
}

resource "azurerm_storage_account_network_rules" "sa-subnet" {
  for_each                   = toset(var.sa.sta1.subnets)
  storage_account_id         = azurerm_storage_account.sa.id
  default_action             = var.default_network_rule
  bypass                     = var.traffic_bypass
  virtual_network_subnet_ids = [data.azurerm_subnet.vnet-subnets[each.value].id]

}

Plan: 7 to add, 0 to change, 0 to destroy.

│ Error: A resource with the ID "/subscriptions/<tenant>/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/storageacct001" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_storage_account_network_rule" for more information.
│
│   with azurerm_storage_account_network_rules.sa-subnet["subnet1"],
│   on sa.tf line 43, in resource "azurerm_storage_account_network_rules" "sa-subnet":
│   43: resource "azurerm_storage_account_network_rules" "sa-subnet" {
│
╵
╷
│ Error: A resource with the ID "/subscriptions/<tenant>/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/storageacct001" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_storage_account_network_rule" for more information.
│
│   with azurerm_storage_account_network_rules.sa-subnet["subnet2"],
│   on sa.tf line 43, in resource "azurerm_storage_account_network_rules" "sa-subnet":
│   43: resource "azurerm_storage_account_network_rules" "sa-subnet" {
│
╵
╷
│ Error: A resource with the ID "/subscriptions/<tenant>/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/storageacct001" already exists - to be managed via Terraform this resource needs to be imported into the State. Please see the resource documentation for "azurerm_storage_account_network_rule" for more information.
│
│   with azurerm_storage_account_network_rules.sa-subnet["subnet3"],
│   on sa.tf line 43, in resource "azurerm_storage_account_network_rules" "sa-subnet":
│   43: resource "azurerm_storage_account_network_rules" "sa-subnet" {
│

我不确定如何将子网名称列表中的subnet_ids 动态传递到存储帐户network_rule 中。 似乎我可以部署此功能的唯一方法是将subnet_ids 硬编码到 terraform.vars 文件中的子网块中。 非常感谢任何帮助！此外，sa 变量中会有更多存储帐户，我只列出了一个。

Answer 1

在 Terraform 中的 azurerm_storage_account 或 azurerm_storage_account_network_rules 中传递多个子网 ID

问题似乎出在你通过的方式上 virtual_network_subnet_ids 当您尝试动态传递它们时。

要为

network_rules

实现此设置子网 ID，请使用数据块获取所有子网详细信息，然后使用循环列出子网 ID，而不直接引用它们。

配置：

data "azurerm_virtual_network" "vnet" {
  name                = "testsamplevnet"
  resource_group_name = data.azurerm_resource_group.rg.name
}

data "azurerm_subnet" "vnet_subnets" {
  for_each = toset(var.sa.sta1.subnets)

  name                 = each.key
  virtual_network_name = data.azurerm_virtual_network.vnet.name
  resource_group_name  = data.azurerm_resource_group.rg.name
}

resource "azurerm_storage_account" "sa" {
  name                     = var.sa.sta1.name
  resource_group_name      = data.azurerm_resource_group.rg.name
  location                 = data.azurerm_resource_group.rg.location
  account_tier             = var.sa.sta1.account_tier
  account_replication_type = var.sa.sta1.replication_type
  account_kind                     = var.sa.sta1.account_kind
  access_tier              = var.sa.sta1.access_tier

  network_rules {
    default_action             = var.default_network_rule
    bypass                     = var.traffic_bypass
    ip_rules                   = var.aamva_vpn_ip_address
    virtual_network_subnet_ids = [for subnet in data.azurerm_subnet.vnet_subnets : subnet.id]
  }

  tags = {
    Billing    = var.sa.sta1.billingTag
    System     = var.sa.sta1.systemTag
    Component  = var.sa.sta1.componentTag
  }
}

部署：

参考：

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/storage_account_network_rules

https://developer.hashicorp.com/terraform/language/expressions/for

https://developer.hashicorp.com/terraform/language/expressions/dynamic-blocks