如何使用 Terraform 递归创建嵌套的 Azure 管理组？答案

【问题标题】：How to recursively create nested Azure Management Groups using Terraform?如何使用 Terraform 递归创建嵌套的 Azure 管理组？
【发布时间】：2022-10-21 23:22:58
【问题描述】：

我正在尝试在 Terraform 中递归地创建嵌套管理组，但我似乎无法使用 count 或 for 或 for_each 来实现它。我能做到的最好的方法是过滤租户级别和非租户级别的组，但这仍然不能帮助我递归地创建它们。

关于如何实现这一点的任何想法？

locals {
  managementGroups = [
    {
      id          = "MainGroupOne"
      displayName = "Main Group One"
      parent      = "Tenant Root Group"
    },
    {
      id          = "MainGroupTwo"
      displayName = "Main Group Two"
      parent      = "Tenant Root Group"
    },
    {
      id          = "GroupOne"
      displayName = "Group One"
      parent      = "MainGroupOne"
      subscriptions = [
        "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", "YYYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY"
      ]
    },
    {
      id          = "ChildOne"
      displayName = "Child One"
      parent      = "GroupOne"
      subscriptions = [
        "ZZZZZZZZ-ZZZZ-ZZZZ-ZZZZ-ZZZZZZZZZZZZ"
      ]
    },
    { id          = "GroupTwo"
      displayName = "Group Two"
      parent      = "MainGroupOne"
    },
    { id          = "GroupThree"
      displayName = "Group Three"
      parent      = "MainGroupTwo"
    }
  ]
}

locals {
  rootGroups = [
    for grp in local.managementGroups : grp
    if grp.parent == "Tenant Root Group"
  ]

  nonRootGroups = [
    for grp in local.managementGroups : grp
    if grp.parent != "Tenant Root Group"
  ]
}

output "rootGroups" {
  value = local.rootGroups
}

output "nonRootGroups" {
  value = local.nonRootGroups
}

resource "azurerm_management_group" "root_groups" {
  count = length(local.rootGroups)

  name             = local.rootGroups[count.index].id
  display_name     = local.rootGroups[count.index].displayName
}

resource "azurerm_management_group" "nonroot_groups" {
  count = length(local.nonRootGroups)

  name         = local.nonRootGroups[count.index].id
  display_name = local.nonRootGroups[count.index].displayName

  ############### PROBLEM AREA ###############
  # parent_management_group_id = ?
  ############### PROBLEM AREA ###############
}

编辑：我想实现这样的目标，但没有在配置本身中硬编码任何东西。

【问题讨论】：

您能否通过“递归”创建它们来澄清您的意思？它不是很清楚你想要实现什么。
谢谢你回来。我已经编辑了问题并添加了我想要实现的屏幕截图。我开始在这些方面做更多的事情，但最终得到了我上面提出的内容。
locals { managementGroups = [ { id = "MainGroupOne" displayName = "Main Group One" 订阅 = [] children = [ { id = "GroupOne" displayName = "Group One" 订阅 = [ "XXX" ] children = [ { id = "ChildOne" displayName = "Child One" 订阅 = [ "YYY" ] }, ] }, ] }, { ... } ] }

标签： azure terraform azure-management-groups

【解决方案1】：

数据“azurerm_subscription”“当前”{} 当地人{ tenant_root_group_id = "/providers/Microsoft.Management/managementGroups/${data.azurerm_subscription.current.tenant_id}" }

【讨论】：