如何使用 for_each 或 count for azure 為多個名稱創建具有存儲帳戶的多個資源組？

Question

如何使用 Azure Terraform 中的列表/計數為用戶列表創建多個具有存儲帳戶的資源組？

我有兩個主文件（main.tf）和一個模塊（users.tf），我想為每個用戶創建一個資源組和一個存儲帳戶。

使用當前設置，我只能在主資源組中為每個用戶創建一個存儲帳戶。

這是我已經取得的成就的示例：

主程序

#azterraform {
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.81.0"
    }
  }
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  features {}    
}

# main Resource Group
resource "azurerm_resource_group" "main-rg" { 
  name      = "RG-MAIN"
  location  = "easteurope"
}

# users module
module "users" {
  source               = "./modules/users"
  resource_group       = azurerm_resource_group.main-rg
  
  for_each             = toset( ["user1", "user2", "user3"] )
  resource_unique_id   = each.key
}

用戶.tf

# Create the Users Resource Group
resource "azurerm_resource_group" "users-rg" {
  name     = upper("RG-${var.resource_unique_id}-${var.config.suffix_nodash}")
  location = var.config.location
  tags     = var.config.tags
}

# Grant contributor access to users ad-group
resource "azurerm_role_assignment" "users-contributor" {
  scope                = azurerm_resource_group.users-rg.id
  role_definition_name = "Contributor"
  principal_id         = var.config.users-adgroup-id
}

# Grant contributor access to DDA Service principal
resource "azurerm_role_assignment" "DDA-sp-contributor" {
  scope                = azurerm_resource_group.users-rg.id
  role_definition_name = "Contributor"
  principal_id         = var.config.dda-service-principal-id
}

# Create storage account in Users resource group
resource "azurerm_storage_account" "users-storage-account" {
  name                     = lower("st${var.resource_unique_id}${var.config.suffix_nodash}")
  resource_group_name      = azurerm_resource_group.users-rg.name
  location                 = azurerm_resource_group.users-rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

變量.tf 文件：

variable "config" {
  description = "(required) configuration variable value from the root module"
}

variable "resource_group" {
  description = "(required) resource group for resources"
}

variable "resource_unique_id" {
  description = "(required) resource unique identifier"
}

配置.json

{
    "config": {
      "region": "East Europe",
      "suffix": "-eeu",
      "suffix_nodash": "eeu",
      "resource-acronym": "dda",      
      "tags": {
        "Creator": "abc@hotmail.com;",
        "Managedby": "abc@hotmail.com; bcd@hotmail.com; cde@hotmail.com;",
        "Project": "DDA",
        "Projectversion": "1.0"
      },
      "location": "easteurope",
      "azure_environment": {
        "resource_manager_url": "https://management.azure.com/",
        "authority": "https://login.microsoftonline.com/"
      },
      "users-adgroup-id": "abcd-abcd-abcd-abcd-abcd",
      "dda-service-principal-id": "xyz-xyz-xyz-xyz-xyz"      
  } 
}

Answer 1

通過以下更改，代碼可以工作：

1. 在定義“config”變量的根模塊級別添加一個 variable.tf 文件

2. 將“config”變量傳遞給 main.tf 中的“users”模塊

3. 使用“-var-file”選項將 config.json 傳遞給 terraform

為了幫助理解，請考慮為您的配置文件使用本機 Terraform 而不是 JSON - 除非您有充分的理由支持后者。

目錄結構

config.json
main.tf
variable.tf   <<<<<<< Added this file
 \modules
    \users
        users.tf
        variable.tf

variable.tf（根模塊級別）

variable "config" {
  description = "(required) configuration variable value from the root module"
}

主程序

# users module
module "users" {
  source               = "./modules/users"
  resource_group       = azurerm_resource_group.main-rg
  config               = var.config           <<<<<<<<<<<<<<<<<<<<<<<<<< Added
  
  for_each             = toset( ["user1", "user2", "user3"] )
  resource_unique_id   = each.key
}

從根模塊目錄執行

terraform init
terraform plan -var-file="./config.json"
terraform apply -var-file="./config.json"

資源列表（運行terraform后申請）

$ az resource list --query "[?contains(name, 'stuser')].{type:type, name:name, resourceGroup:resourceGroup}"
[
  {
    "name": "stuser1eeu",
    "resourceGroup": "RG-USER1-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  },
  {
    "name": "stuser2eeu",
    "resourceGroup": "RG-USER2-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  },
  {
    "name": "stuser3eeu",
    "resourceGroup": "RG-USER3-EEU",
    "type": "Microsoft.Storage/storageAccounts"
  }
]