azure - Terraform Azure 数据工厂身份

Question

我正在尝试为新创建的数据工厂授予对 key 保管库的访问权限。为了实现这一点，我有以下代码......

    module "subscription" {
      source = "../../general/subscription_getdetails"
    }
    
    module "df_resourcegroup" {
      source = "../../general/rg_getdetails"
      rg_name_solution = var.df_rg_name_solution
      rg_name_seqnr    = var.df_rg_name_seqnr
    }
    
    module "location" {
      source = "../../general/location/location_getdetails"
      location_name = var.df_location_name
      location_tier = var.df_location_tier
    }
    
    module "keyvault" {
      source = "../../security/kv_getdetails"
      kv_name_solution    = var.kv_name_solution
      kv_name_seqnr       = var.kv_name_seqnr
      kv_name_purpose     = var.kv_name_purpose
      kv_location_name    = var.kv_location_name
      kv_location_tier    = var.kv_location_tier
      kv_rg_name_solution = var.kv_rg_name_solution
      kv_rg_name_seqnr    = var.kv_rg_name_seqnr
    }
    
    resource "azurerm_data_factory" "df" {
      name                     = "adf-${module.df_resourcegroup.sitecode}-${module.subscription.environment}-${var.df_name_dataset}-${var.df_name_seqnr}"
      location                 = module.location.azure
      resource_group_name      = module.df_resourcegroup.rg.name
      public_network_enabled   = var.df_allow_public_access
  identity {
      type = "SystemAssigned"
  }    }
    
    
    resource "azurerm_key_vault_access_policy" "df_grant_keyvault_read" {
      key_vault_id = module.keyvault.kv.id
      tenant_id    = azurerm_data_factory.df.identity[0].tenant_id
      object_id    = azurerm_data_factory.df.identity[0].principal_id
    
      key_permissions = [
        "Get",
      ]
    
      secret_permissions = [
        "Get",
      ]
    }

但是这肯定有问题，因为我收到了这个错误...(我尝试不将其作为列表来处理，但不起作用)。

│ Error: Invalid index
│ 
│   on _modules/das/df_create/main.tf line 68, in resource "azurerm_key_vault_access_policy" "df_grant_keyvault_read":
│   68:   tenant_id    = azurerm_data_factory.df.identity[0].tenant_id
│     ├────────────────
│     │ azurerm_data_factory.df.identity is empty list of object
│ 
│ The given key does not identify an element in this collection value.

Answer 1

当我尝试使用 SelfSigned Identity 时，我得到:

│ 参数“object_id”是必需的，但未找到定义。

这是已知问题，已在 Github 上报告。为了克服这个问题，我们可以使用数据源azure_service_principal

    module "subscription" {
      source = "../../general/subscription_getdetails"
    }
    
    module "df_resourcegroup" {
      source = "../../general/rg_getdetails"
      rg_name_solution = var.df_rg_name_solution
      rg_name_seqnr    = var.df_rg_name_seqnr
    }
    
    module "location" {
      source = "../../general/location/location_getdetails"
      location_name = var.df_location_name
      location_tier = var.df_location_tier
    }
    
    module "keyvault" {
      source = "../../security/kv_getdetails"
      kv_name_solution    = var.kv_name_solution
      kv_name_seqnr       = var.kv_name_seqnr
      kv_name_purpose     = var.kv_name_purpose
      kv_location_name    = var.kv_location_name
      kv_location_tier    = var.kv_location_tier
      kv_rg_name_solution = var.kv_rg_name_solution
      kv_rg_name_seqnr    = var.kv_rg_name_seqnr
    }
    
    resource "azurerm_data_factory" "df" {
      name                     = "adf-${module.df_resourcegroup.sitecode}-${module.subscription.environment}-${var.df_name_dataset}-${var.df_name_seqnr}"
      location                 = module.location.azure
      resource_group_name      = module.df_resourcegroup.rg.name
      public_network_enabled   = var.df_allow_public_access
  identity {
      type = "SystemAssigned"
  }    }

data "azuread_service_principal" "data_factory_managed_identity" {
  object_id = azurerm_data_factory.df.identity.0.principal_id
}
    
    
    resource "azurerm_key_vault_access_policy" "df_grant_keyvault_read" {
      key_vault_id = module.keyvault.kv.id
      tenant_id    = azurerm_data_factory.df.identity[0].tenant_id
      object_id    = data.azuread_service_principal.data_factory_managed_identity.object_id
    
      key_permissions = [
        "Get",
      ]
    
      secret_permissions = [
        "Get",
      ]
    }