使用共享映像库的多租户部署答案

【问题标题】：Multi-tenant deployment using Shared Image gallery使用共享映像库的多租户部署
【发布时间】：2020-12-07 19:10:40
【问题描述】：

我正在尝试在租户 2 中创建一个虚拟机，并在租户 1 中使用共享映像库。

下面是我正在使用的代码。

租户 - 2

provider "azurerm" {

  subscription_id = "${var.subscription_id}"

  client_id       = "${var.client_id}"

  client_secret   = "${var.client_secret}"

  tenant_id       = "${var.tenant_id}"
}

租户 - 1

获取 SIG 资源的提供者

provider "azurerm" {

  alias           = "sig-resources-id"

  subscription_id = "${var.sig_subscription_id}"

  client_id       = "${var.sig_client_id}"

  client_secret   = "${var.sig_client_secret}"

  tenant_id       = "${var.sig_tenant_id}"

}

我从租户 1 获取映像 ID，并在 azurerm_virtual_machine 中使用它在租户 2 中创建 VM

Error: compute.VirtualMachinesClient#CreateOrUpdate: Failure sending request: StatusCode=403 -- Original Error: Code="LinkedAuthorizationFailed" Message="The client has permission to perform action 'Microsoft.Compute/galleries/images/versions/read' on scope '/subscriptions/subscription-ID-of-tenant-2/resourceGroups/mygroup/providers/Microsoft.Compute/virtualMachines/sigvm-01', however the current tenant '<Tenant-2 ID>' is not authorized to access linked subscription '<subscription-ID-of-tenant-1>'."

非常感谢任何帮助。

【问题讨论】：

标签： terraform terraform-provider-azure

【解决方案1】：

这里似乎已修复https://github.com/terraform-providers/terraform-provider-azurerm/pull/4290

根据修复，请将属性auxiliary_tenant_ids = [""] 如下添加到租户 - 1

provider "azurerm" {

  subscription_id = "${var.subscription_id}"

  client_id       = "${var.client_id}"

  client_secret   = "${var.client_secret}"

  tenant_id       = "${var.tenant_id}"

  auxiliary_tenant_ids = ["${var.sig_tenant_id}"]
}

希望这会有所帮助！

【讨论】：