无法在 terraform azure 提供程序中获取 SystemAssigned 身份属性

Question

使用以下应用服务定义

data "azurerm_resource_group" "rg" {
  name = var.resource_group_name
}

# Creates our new App Service
resource "azurerm_app_service" "app" {
  name                    = var.app_name
  app_service_plan_id     = var.app_service_plan_id
  location                = data.azurerm_resource_group.rg.location
  resource_group_name     = data.azurerm_resource_group.rg.name
  client_affinity_enabled = false
  enabled                 = true
  https_only              = true

  app_settings = var.app_settings

  site_config {
    always_on                 = true
    http2_enabled             = true
    use_32_bit_worker_process = false
    scm_type                  = "LocalGit"
    default_documents         = var.default_documents

    cors {
      allowed_origins     = var.cors_allowed_origins
      support_credentials = var.cors_enabled
    }
  }

  identity {
    type = "SystemAssigned"
  }

我正在设置 keyvault 访问策略

resource "azurerm_key_vault_access_policy" "app" {
  key_vault_id       = var.key_vault_id
  tenant_id          = azurerm_app_service.app.identity[0].tenant_id
  object_id          = azurerm_app_service.app.identity[0].principal_id
  secret_permissions = ["get", "list"]
}

然而 azure provider for terraform 给出了这个错误

Error: "object_id": required field is not set

  on ..\modules\app-service\main.tf line 68, in resource "azurerm_key_vault_access_policy" "app":
  68: resource "azurerm_key_vault_access_policy" "app" {



Error: "tenant_id": required field is not set

  on ..\modules\app-service\main.tf line 68, in resource "azurerm_key_vault_access_policy" "app":
  68: resource "azurerm_key_vault_access_policy" "app" {

好像身份块没有提供tenant_id和principal_id属性

有什么想法吗？

Answer 1

应该是这样的：

${azurerm_app_service.app.identity.0.tenant_id}
${azurerm_app_service.app.identity.0.principal_id}

https://www.terraform.io/docs/providers/azurerm/r/app_service.html#attributes-reference

Answer 2

问题原来是 azure 中的应用服务关闭了“SystemAssigned”，这导致计划和申请失败。修复 azure 服务解决了我们的问题。我们的问题可能也可以通过污染应用服务以及破坏和重建基础设施来解决。