如何使用 for_each 或 count for azure 为多个名称创建具有存储帐户的多个资源组？

Question

如何使用 Azure Terraform 中的列表/计数为用户列表创建多个具有存储帐户的资源组？

我有两个主文件（main.tf）和一个模块（users.tf），我想为每个用户创建一个资源组和一个存储帐户。

使用当前设置，我只能在主资源组中为每个用户创建一个存储帐户。

这是我已经取得的成就的示例：

主程序

#azterraform {
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.81.0"
    }
  }
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  features {}    
}

# main Resource Group
resource "azurerm_resource_group" "main-rg" { 
  name      = "RG-MAIN"
  location  = "easteurope"
}

# users module
module "users" {
  source               = "./modules/users"
  resource_group       = azurerm_resource_group.main-rg
  
  for_each             = toset( ["user1", "user2", "user3"] )
  resource_unique_id   = each.key
}

用户.tf

# Create the Users Resource Group
resource "azurerm_resource_group" "users-rg" {
  name     = upper("RG-${var.resource_unique_id}-${var.config.suffix_nodash}")
  location = var.config.location
  tags     = var.config.tags
}

# Grant contributor access to users ad-group
resource "azurerm_role_assignment" "users-contributor" {
  scope                = azurerm_resource_group.users-rg.id
  role_definition_name = "Contributor"
  principal_id         = var.config.users-adgroup-id
}

# Grant contributor access to DDA Service principal
resource "azurerm_role_assignment" "DDA-sp-contributor" {
  scope                = azurerm_resource_group.users-rg.id
  role_definition_name = "Contributor"
  principal_id         = var.config.dda-service-principal-id
}

# Create storage account in Users resource group
resource "azurerm_storage_account" "users-storage-account" {
  name                     = lower("st${var.resource_unique_id}${var.config.suffix_nodash}")
  resource_group_name      = azurerm_resource_group.users-rg.name
  location                 = azurerm_resource_group.users-rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

变量.tf 文件：

variable "config" {
  description = "(required) configuration variable value from the root module"
}

variable "resource_group" {
  description = "(required) resource group for resources"
}

variable "resource_unique_id" {
  description = "(required) resource unique identifier"
}

配置.json

{
    "config": {
      "region": "East Europe",
      "suffix": "-eeu",
      "suffix_nodash": "eeu",
      "resource-acronym": "dda",      
      "tags": {
        "Creator": "abc@hotmail.com;",
        "Managedby": "abc@hotmail.com; bcd@hotmail.com; cde@hotmail.com;",
        "Project": "DDA",
        "Projectversion": "1.0"
      },
      "location": "easteurope",
      "azure_environment": {
        "resource_manager_url": "https://management.azure.com/",
        "authority": "https://login.microsoftonline.com/"
      },
      "users-adgroup-id": "abcd-abcd-abcd-abcd-abcd",
      "dda-service-principal-id": "xyz-xyz-xyz-xyz-xyz"      
  } 
}

Answer 1

通过以下更改，代码可以工作：

1. 在定义“config”变量的根模块级别添加一个 variable.tf 文件

2. 将“config”变量传递给 main.tf 中的“users”模块

3. 使用“-var-file”选项将 config.json 传递给 terraform

为了帮助理解，请考虑为您的配置文件使用本机 Terraform 而不是 JSON - 除非您有充分的理由支持后者。

目录结构

config.json
main.tf
variable.tf   <<<<<<< Added this file
 \modules
    \users
        users.tf
        variable.tf

variable.tf（根模块级别）

variable "config" {
  description = "(required) configuration variable value from the root module"
}

主程序

# users module
module "users" {
  source               = "./modules/users"
  resource_group       = azurerm_resource_group.main-rg
  config               = var.config           <<<<<<<<<<<<<<<<<<<<<<<<<< Added
  
  for_each             = toset( ["user1", "user2", "user3"] )
  resource_unique_id   = each.key
}

从根模块目录执行

terraform init
terraform plan -var-file="./config.json"
terraform apply -var-file="./config.json"

资源列表（运行terraform后申请）

$ az resource list --query "[?contains(name, 'stuser')].{type:type, name:name, resourceGroup:resourceGroup}"
[
  {
    "name": "stuser1eeu",
    "resourceGroup": "RG-USER1-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  },
  {
    "name": "stuser2eeu",
    "resourceGroup": "RG-USER2-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  },
  {
    "name": "stuser3eeu",
    "resourceGroup": "RG-USER3-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  }
]