Terraform - Azure 资源组：错误：ID 不能是资源组 ID

Question

我目前正在将我们的云基础架构迁移到 Terraform。 我正在尝试将策略分配给资源组。 但是它失败并出现错误

│ 错误：ID 不能是资源组 ID

│ 使用 azurerm_resource_policy_assignment.example，在 main.tf 第 50 行，资源中的 zurerm_resource_policy_assignment""example"：

│ 50：resource_id = azurerm_resource_group.example.id

# Configure the Microsoft Azure provider
provider "azurerm" {
  features {}
}

data "azurerm_subscription" "primary" {
}

data "azurerm_client_config" "example" {
}

# Define Policy
resource "azurerm_policy_definition" "example" {
  display_name = "only-deploy-in-westus"
  name        = "only-deploy-in-westus"
  policy_type = "Custom"
  mode        = "All"

  policy_rule = <<POLICY_RULE
    {
    "if": {
      "not": {
        "field": "location",
        "equals": "westus"
      }
    },
    "then": {
      "effect": "Deny"
    }
  }
POLICY_RULE
}

# Create a Resource Group if it doesn’t exist
resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West US"
}

# Assign Permission
resource "azurerm_role_assignment" "example" {
  scope                = azurerm_resource_group.example.id
  role_definition_name = "Reader"
  principal_id         = data.azurerm_client_config.example.object_id
}

# Assign Policy
resource "azurerm_resource_policy_assignment" "example" {
  name                 = "example-policy-assignment"
  resource_id          = azurerm_resource_group.example.id
  policy_definition_id = azurerm_policy_definition.example.id
}

Answer 1

它应该是：

resource_group_id = azurerm_resource_group.example.id

而不是

resource_id = azurerm_resource_group.example.id

Answer 2

为了将策略分配给资源组，您不能使用azurerm_resource_policy_assignment但需要使用azurerm_resource_group_policy_assignment 。

resource "azurerm_resource_group_policy_assignment" "example" {
  name                 = "example"
  resource_group_id    = azurerm_resource_group.example.id
  policy_definition_id = azurerm_policy_definition.example.id
}

参考： https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group_policy_assignment