如何使用 terraform 将多个 vnet 的多个子网动态添加到 azure servicebus 防火墙答案

【问题标题】：How to add multiple subnets of multiple vnets to azure servicebus firewall dynamically using terraform如何使用 terraform 将多个 vnet 的多个子网动态添加到 azure servicebus 防火墙
【发布时间】：2021-11-28 15:13:04
【问题描述】：

如何使用terraform将多个VNET的多个子网动态添加到Azure ServiceBus防火墙？

以下是 terraform 代码。 VNET 和子网在 tf 代码的 locals 部分中可用。

所以我在 azure 中有三个 VNET（vnet1、vnet2 和 vnet3），每个 VNET 都有多个子网。


locals {
 virtual_network_name1 = "vnet1"
 virtual_network_name2 = "vnet2"
 virtual_network_name3 = "vnet3"
 subnets = {
   sub1 : {
     subnet1 = "vnet1-subnet1",
     subnet2 = "vnet1-subnet2",
     subnet3 = "vnet1-subnet3"
   },
   sub2: {
     subnet1 = "vnet2-subnet1",
     subnet2 = "vnet2-subnet2",
     subnet3 = "vnet2-subnet3"
   }
sub3: {
     subnet1 = "vnet3-subnet1",
     subnet2 = "vnet3-subnet2",
     subnet3 = "vnet3-subnet3"
   }
 
}
}

data "azurerm_virtual_network" "vnet" {
 name                 = local.virtual_network_name
 resource_group_name  = "westy"
}

data "azurerm_subnet" "subnets" {
 for_each             = local.subnets
 name                 = each.value
 resource_group_name  = "westy"
 virtual_network_name = data.azurerm_virtual_network.vnet.name

}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_servicebus_namespace" "example" {
  name                = "example-sb-namespace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "Premium"

  capacity = 1
}


resource "azurerm_servicebus_namespace_network_rule_set" "example" {
  namespace_name      = azurerm_servicebus_namespace.example.name
  resource_group_name = azurerm_resource_group.example.name

  default_action = "Deny"

  trusted_services_allowed = true

  network_rules {
    subnet_id                            = data.azurerm_subnet.subnets
    ignore_missing_vnet_service_endpoint = false
  }


  ip_rules = ["125.123.142.174"]
 
 
}

实际上，这些是现有的 VNET，并且已经创建了子网

我想迭代这些 vnet，例如 vnet1 迭代第一组子网，vnet2 迭代第二组子网，与 vnet3 相同。这就是各个子网如何与这些 vnet 关联并使用 terraform 动态地将它们添加到“azurerm_servicebus_namespace_network_rule_set”资源的网络块中的方式？

有没有可能实现？

【问题讨论】：

您根本没有使用本地变量。您究竟是如何创建您的 vnet virtual_network_name1 和其他人的？这与您的subnets 有何关系？
我忘记补充这些 vnet 和子网已经创建，我想使用数据源 terraform 资源将它们添加到服务总线的网络规则集中。我如何实现它？
@AnsumanBal-MT 谢谢。它按预期完美运行。
很高兴为您提供帮助 @devops-admin :)

标签： azure terraform terraform-provider-azure

【解决方案1】：

您可以使用以下代码来满足您的要求：

provider "azurerm"{
  features{}
}
locals {
 vnet_list = {    
  "vnet1" = [{"subnet_name"=[
                    "subnet1",
                    "subnet2",
                    "subnet3"
  ]
  }],
  "vnet2" = [{"subnet_name"=[
                    "subnet1",
                    "subnet2",
                    "subnet3"
  ]
                 }], 
  "vnet3" = [{"subnet_name"=[
                    "subnet1",
                    "subnet2",
                    "subnet3"
                  ]
  }]
}
vnet = merge([
    for vnet_name, vnet in local.vnet_list : {
      for subnet in vnet[0].subnet_name :
          "${vnet_name}-${subnet}" => {
            name               = vnet_name
            subnet_name  =  subnet
          }
    }
  ]...)
}
data "azurerm_resource_group" "example" {
  name     = "myresourcegroup"
}

resource "azurerm_servicebus_namespace" "example" {
  name                = "ansuman-sb-namespace"
  location            = data.azurerm_resource_group.example.location
  resource_group_name = data.azurerm_resource_group.example.name
  sku                 = "Premium"

  capacity = 1
}

data "azurerm_subnet" "example"{
  for_each = local.vnet
  name=each.value.subnet_name
  virtual_network_name=each.value.name
  resource_group_name=data.azurerm_resource_group.example.name
}

resource "azurerm_servicebus_namespace_network_rule_set" "example" {
  namespace_name      = azurerm_servicebus_namespace.example.name
  resource_group_name = data.azurerm_resource_group.example.name
  default_action = "Deny"
  trusted_services_allowed = true

  dynamic "network_rules" {
    for_each=data.azurerm_subnet.example
    content{
    subnet_id                            = network_rules.value["id"]
    ignore_missing_vnet_service_endpoint = false
  }
  }
  ip_rules = ["125.123.142.174"]
}

输出：

9 个子网已全部添加到网络规则中：

传送门：

【讨论】：