azure - 根据输入在 Terraform 中动态创建角色分配

Question

我正在尝试使用下面给出的典型变量创建多个角色分配，其中“permission {}”是我想以类型映射的形式引入的新变量，因此我可以执行多个角色分配。

我的 TFVARS 文件

azure_vnets= {
  prod= [
    {
      cidr = ["10.0.0.0/24"]
      vnet_name = "vnet1"
      dns  = ["10.0.0.1"]
      rg   = "myrg1"
      permission = {
      Contributor =  ["xxxxxxxxxxxx", "xxxxxxxxxxxxx"],
      Reader = ["xxxxxxxxxxx", "xxxxxxxxxx"]
      } 
      location = "eastus"
    },
    {
      cidr = ["10.0.1.0/24"]
      vnet_name = "vnet2"
      dns  = ["10.0.1.2"]
      rg   = "myrg2"
      permission = {
      Contributor =  ["xxxxxxxxxxxx", "xxxxxxxxxxxxx"],
      Reader = ["xxxxxxxxxxx", "xxxxxxxxxx"]
      } 
      location = "westeurope"
    }
  ],
  nonprod = [
     {
      cidr = ["10.0.3.0/24"]
      vnet_name = "vnet1"
      dns  = ["10.0.3.1"]
      rg   = "nonprodrg"
      location = "eastus"
      permission = {
      Contributor =  ["xxxxxxxxxxxx", "xxxxxxxxxxxxx"],
      Reader = ["xxxxxxxxxxx", "xxxxxxxxxx"]
      } 
    },
    {
      cidr = ["10.0.4.0/24"]
      vnet_name = "nonprod-vnet2"
      dns  = ["10.0.4.2"]
      sub  = "nonProd"
      rg   = "mynonprodrg"
      permission = {
      Contributor =  ["xxxxxxxxxxxx", "xxxxxxxxxxxxx"],
      Reader = ["xxxxxxxxxxx", "xxxxxxxxxx"]
      } 
      location = "westeurope"
    }
  ]
}

我的资源创建文件我在这里定义了一个本地变量，它可以帮助我在角色分配创建中下面给出的 for_each 循环中使用上述变量。我想知道如何从上面的 TFvar 变量获取下面 for_each role_assignment 创建中的 Rolename 作为 Key 和 ObjectID 作为值

locals {
  flat_azure_vnets = merge([
      for env_name, env_vn_list in var.azure_vnets:
         {
           for idx, env_vn in env_vn_list:
             "${env_name}-${idx}" => env_vn
         }
    ]...)
}


resource "azurerm_role_assignment" "role_assignment" {
    for_each = { for k, v in local.flat_azure_vnets  : k => v }
    scope                = azurerm_resource_group.this.id
    role_definition_name = each.xxx
    principal_id         = each.key
}

Answer 1

要迭代新的permission 属性，您必须进一步扁平化您的flat_azure_vnets。所以你可以引入flat_azure_vnets2:

locals {
  flat_azure_vnets = merge([
      for env_name, env_vn_list in var.azure_vnets:
         {
           for idx, env_vn in env_vn_list:
             "${env_name}-${idx}" => env_vn
         }
    ]...)
    

  flat_azure_vnets2 = merge([
      for key, env in local.flat_azure_vnets:
         {
           for cidx, contrinutor in env["permission"]["Contributor"]:
             "${key}-${cidx}" => merge(
                   env, {
                       "contrinutor" = contrinutor,
                       "reader" = env["permission"]["Reader"][cidx]
                       }
               )
         }
    ]...)
}

以以下形式生成 flat_azure_vnets2(注意新的 contrinutor 和 reader 属性):

test = {
  "nonprod-0-0" = {
    "cidr" = [
      "10.0.3.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxx"
    "dns" = [
      "10.0.3.1",
    ]
    "location" = "eastus"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxxx"
    "rg" = "nonprodrg"
    "vnet_name" = "vnet1"
  }
  "nonprod-0-1" = {
    "cidr" = [
      "10.0.3.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxxx"
    "dns" = [
      "10.0.3.1",
    ]
    "location" = "eastus"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxx"
    "rg" = "nonprodrg"
    "vnet_name" = "vnet1"
  }
  "nonprod-1-0" = {
    "cidr" = [
      "10.0.4.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxx"
    "dns" = [
      "10.0.4.2",
    ]
    "location" = "westeurope"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxxx"
    "rg" = "mynonprodrg"
    "sub" = "nonProd"
    "vnet_name" = "nonprod-vnet2"
  }
  "nonprod-1-1" = {
    "cidr" = [
      "10.0.4.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxxx"
    "dns" = [
      "10.0.4.2",
    ]
    "location" = "westeurope"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxx"
    "rg" = "mynonprodrg"
    "sub" = "nonProd"
    "vnet_name" = "nonprod-vnet2"
  }
  "prod-0-0" = {
    "cidr" = [
      "10.0.0.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxx"
    "dns" = [
      "10.0.0.1",
    ]
    "location" = "eastus"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxxx"
    "rg" = "myrg1"
    "vnet_name" = "vnet1"
  }
  "prod-0-1" = {
    "cidr" = [
      "10.0.0.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxxx"
    "dns" = [
      "10.0.0.1",
    ]
    "location" = "eastus"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxx"
    "rg" = "myrg1"
    "vnet_name" = "vnet1"
  }
  "prod-1-0" = {
    "cidr" = [
      "10.0.1.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxx"
    "dns" = [
      "10.0.1.2",
    ]
    "location" = "westeurope"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxxx"
    "rg" = "myrg2"
    "vnet_name" = "vnet2"
  }
  "prod-1-1" = {
    "cidr" = [
      "10.0.1.0/24",
    ]
    "contrinutor" = "xxxxxxxxxxxxx"
    "dns" = [
      "10.0.1.2",
    ]
    "location" = "westeurope"
    "permission" = {
      "Contributor" = [
        "xxxxxxxxxxxx",
        "xxxxxxxxxxxxx",
      ]
      "Reader" = [
        "xxxxxxxxxxx",
        "xxxxxxxxxx",
      ]
    }
    "reader" = "xxxxxxxxxx"
    "rg" = "myrg2"
    "vnet_name" = "vnet2"
  }
}