terraform 私有端点私有 dns 区域无法填充

Question

i have following code to create private endpoint, and if provided, will be associated with a private dns zone as well, however, the private endpoint is crated ignoring private dns zone value I entered, treat it as Null resource. I'm not sure what went wrong inside the dynamic block

resource "azurerm_private_endpoint" "this" {
  name                = join("", [lookup(var.service_subresource_map, "name"), "-pvt-endpoint"])
  location            = var.location
  resource_group_name = var.resource_group_name
  subnet_id           = data.azurerm_subnet.endpoint_subnet.id
  tags                = var.tags

  private_service_connection {
    name                           = join("", [lookup(var.service_subresource_map, "name"), "-pvt-endpoint-conn"])
    private_connection_resource_id = lookup(var.service_subresource_map, "resource_id")
    subresource_names              = [lookup(var.service_subresource_map, "subresource_name")]
    is_manual_connection           = false
  }

  dynamic "private_dns_zone_group" {
    for_each = var.private_dns_zone_group[*]

    content {
      name                 = private_dns_zone_group.value.name
      private_dns_zone_ids = private_dns_zone_group.value.private_dns_zone_ids
    }
  }

the value I provided in private_dns_zone_group is this

private_dns_zone_group = {
    name = "private-dns-zone-group"
    private_dns_zone_ids = [
      "/subscriptions/xxx/resourceGroups/rogertest/providers/Microsoft.Network/privateDnsZones/example.com",
    ]
  }

and variable is as following

variable "private_dns_zone_group" {
 
  type = object({
    name                 = string
    private_dns_zone_ids = list(string)
  })
  default = null
}

everything is deployed without error except for private dns zone association

if I replace dynamic block with simple block like this

private_dns_zone_group {
    name                 = "private-dns-zone-group"
    private_dns_zone_ids = [
      "/subscriptions/xxx/resourceGroups/rogertest/providers/Microsoft.Network/privateDnsZones/example.com",
    ]
  }

then it works.

Answer 1

Depending on your service, if you want to use Private Endpoint then you will have to properly name as per the naming convention for the Private DNS Zones which can referred from this Microsoft Documentation . For example, If you are creating Private Endpoint for App Service , Storage and SQL , then your Private DNS Group will have Id's of Zones with names : ['privatelink.azurewebsites.net','privatelink.blob.core.windows.net','privatelink.database.windows.net'] .

I tested the same for only app service by using your code:

.tfvars

private_dns_zone_group = {
    name                 = "private-dns-zone-group"
    private_dns_zone_ids = [
      "/subscriptions/xxxxx/resourceGroups/xxxxx/providers/Microsoft.Network/privateDnsZones/privatelink.azurewebsites.net"
    ]
}

Main.tf

provider "azurerm" {
  features{}
}

variable "private_dns_zone_group" {
 
  type = object({
    name                 = string
    private_dns_zone_ids = list(string)
  })
  default = null
}
data "azurerm_subnet" "endpoint_subnet" {
  name                 = "default"
  virtual_network_name = "ansuman-vnet"
  resource_group_name  = "xxxxxx"
}

resource "azurerm_private_endpoint" "this" {
  name                = "appservice-pvt-endpoint"
  location            = "west us 2"
  resource_group_name = data.azurerm_subnet.endpoint_subnet.resource_group_name
  subnet_id           = data.azurerm_subnet.endpoint_subnet.id

  private_service_connection {
    name                           =  "appservice-pvt-endpoint-conn"
    private_connection_resource_id = "/subscriptions/xxxxx/resourcegroups/xxxxx/providers/Microsoft.Web/sites/ansumantestapp"
    subresource_names              = ["sites"]
    is_manual_connection           = false
  }

  dynamic "private_dns_zone_group" {
    for_each = var.private_dns_zone_group[*]

    content {
      name                 = private_dns_zone_group.value.name
      private_dns_zone_ids = private_dns_zone_group.value.private_dns_zone_ids
    }
  }
}

Output:

Note:

• Please make sure you have the latest versions of Azurerm Provider and Terraform .

• If you are still getting the error then try removing the default argument from the Private DNS group variable block:

   variable "private_dns_zone_group" { type = object({ name = string private_dns_zone_ids = list(string) }) default = null ## remove this argument }

Answer 2

Finally found out the reason.. I put resource "azurerm_private_endpoint" "this" as a module, when I'm calling the module, I forgot to include private_dns_zone_group = var.private_dns_zone_group

so of course, it's always missing the tfvar value.... always something so simple...