错误 Key Vault object_id 是无效的 UUID - Terraform/Azure

Question

我正在 Terraform 中部署一个 Azure 应用程序网关，我想将我的 SSL 私有证书存储在 Inte.net 和我的 App-gtw 之间的 Azure Key Vault 中。 省略了应用程序网关模块中无用信息的代码是：

module "agw_user_assigned_identity" {
  source = "../modules/resources-blocks/user_assigned_identity"

  user_assigned_identity_name  = "agw-user-signed-id"
  resource_group_name     = module.resource_group.name
  resource_group_location = module.resource_group.location
}

module "key_vault" {
  source = "../modules/resources/key_vault"

  key_vault_name = local.key_vault_name
  resource_group_location = module.resource_group.location
  resource_group_name     = module.resource_group.name

  tenant_id = data.azurerm_client_config.current.tenant_id
  object_id = module.agw_user_assigned_identity.id

  soft_delete_retention_days  = 90

  log_analytics_workspace_id = module.log_analytics_workspace.id
  enable_diagnostic_setting  = true
}

module "key_vault_private_certificate" {
  source = "../modules/resources-blocks/key_vault_certificate"

  key_vault_id         = module.key_vault.id
  certificate_name     = local.agw_certificate_name
  certificate_path     = "./certificates/xxxxx.pfx"
  certificate_password = var.SSL_CERTIFICATE_PASSWORD
}

resource "null_resource" "previous" {}

module "agw_time_sleep" {
  source = "../modules/resources-blocks/time_sleep"

  select_module = module.key_vault
  seconds = "200s"
}

module "application_gateway" {
  source = "../modules/resources-hub/application_gateway"

  resource_group_name        = module.resource_group.name
  resource_group_location    = module.resource_group.location
  application_gateway_name   = local.agw_name

  key_vault_private_certificate_id = module.key_vault_private_certificate.certificate_id
  key_vault_private_certificate_id = azurerm_key_vault_certificate.kv_certificate.secret_id
  ssl_certificate_name             = local.agw_certificate_name
  agw_time_sleep                   = module.agw_time_sleep.id

  frontend_ports = [
    {
      name = "myFrontendPort"
      port = 443
    }
  ]


  http_listeners = [
    {
      name                      = "devListener" 
      frontend_ip_configuration = local.frontend_ip_configuration_name
      frontend_port_name        = "myFrontendPort" 
      protocol                  = "Https"
      hostname                  = "xxxxxxxxxxxxx.be"
      ssl_certificate_name      = local.agw_certificate_name
    }
  ]
}

key_vault 资源是：

resource "azurerm_key_vault" "kv" {
  name                        = var.key_vault_name
  location                    = var.resource_group_location
  resource_group_name         = var.resource_group_name
  enabled_for_disk_encryption = true
  tenant_id                   = var.tenant_id
  soft_delete_retention_days  = var.soft_delete_retention_days
  purge_protection_enabled    = false

  sku_name = "standard"

  access_policy {
    tenant_id = var.tenant_id
    object_id = var.object_id

    key_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Recover", ]

    secret_permissions = ["Get", "List", "Set", "Delete", "Recover", "Backup", "Restore", "Purge"]

    storage_permissions = ["Get", "Set", "Delete", "Recover", "Backup", "Restore"]

    certificate_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Recover", "Backup", "Restore", "Purge"]
  }

  lifecycle {
    ignore_changes = [access_policy]
  }
}

key_vault_certificate 资源是：

resource "azurerm_key_vault_certificate" "kv_certificate" {
  name         = var.certificate_name
  key_vault_id = var.key_vault_id

  certificate {
    contents = filebase64(var.certificate_path)
    password = var.certificate_password
  }
  certificate_policy {
    issuer_parameters {
      name = "Self"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = false
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }
  }
}

应用网关资源为（省略无用信息）：

resource "azurerm_application_gateway" "app_gw" {
  name                = var.application_gateway_name
  resource_group_name = var.resource_group_name
  location            = var.resource_group_location

  identity {
    type = "UserAssigned"
    identity_ids = [var.user_assigned_identity_id]
  }

  ssl_certificate {
    name     = var.ssl_certificate_name
    key_vault_secret_id = var.key_vault_private_certificate_id
  }

  dynamic "http_listener" {
    for_each = var.http_listeners
    content {
      name                           = http_listener.value.name
      frontend_ip_configuration_name = http_listener.value.frontend_ip_configuration
      frontend_port_name             = http_listener.value.frontend_port_name
      protocol                       = http_listener.value.protocol
      host_name                      = http_listener.value.hostname
      firewall_policy_id             = var.firewall_policy_id
      ssl_certificate_name           = http_listener.value.ssl_certificate_name
    } 
  }

  depends_on = [var.agw_time_sleep]

}

使用命令 terraform plan -var-file="variables.tfvars" 时出现的错误是：

Error: expected "access_policy.0.object_id" to be a valid UUID, got /subscriptions/xxxxxxxx/resourceGroups/xxxxxxxxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/agw-user-signed-id
│
│   with azurerm_key_vault.kv,
│   on main.tf line 344, in resource "azurerm_key_vault" "kv":
│  344:     object_id    = module.agw_user_assigned_identity.id

显然问题似乎与我在 key_vault 中指定的 object_id 有关，但我不知道如何解决它。

Answer 1

错误说明

Error: expected "access_policy.0.object_id" to be a valid UUID .......
with azurerm_key_vault.kv,
│   on main.tf line 344, in resource "azurerm_key_vault" "kv":
│  344:     object_id    = module.agw_user_assigned_identity.id

这意味着在您的access_policy块中的资源azurerm_key_vault中， object_id属性正在获取不正确的值，更简单地说是 azure API 为其接受的不正确值。

它期望来自azurerm_user_assigned_identity资源的principal_id output 而不是id 。

在 azure 中， id将是资源本身在 azure 命名空间/subscriptions/<sub-id>/resourceGroups/<resource-group-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<resource-name>

所以你需要principal_id output 在你的模块module.agw_user_assigned_identity然后在你的 key_vault 模块中使用它如下

Terraform 代码

## inside module.agw_user_assigned_identity add an output , ignore if already exists 

output "principal_id" {
  value       = azurerm_user_assigned_identity.base.principal_id
  description = "Set accordingly or from terraform documentation"
}

## then use the above the output in key_vault module
module "key_vault" {
  source = "../modules/resources/key_vault"

  key_vault_name = local.key_vault_name
  resource_group_location = module.resource_group.location
  resource_group_name     = module.resource_group.name

  tenant_id = data.azurerm_client_config.current.tenant_id
  object_id = module.agw_user_assigned_identity.principal_id

  soft_delete_retention_days  = 90

  log_analytics_workspace_id = module.log_analytics_workspace.id
  enable_diagnostic_setting  = true
}

这将解决上述错误消息。