azure - Terraform 在 Azure 应用程序配置上挂起

Question

我不知道为什么它会挂起

azurerm_app_configuration_key.ai_connection_string: Still creating... [27m21s elapsed]

我认为这与依赖关系有关，但我不确定。地形新手。有什么想法吗？

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.65.0"
    }
  }
}

provider "azurerm" {
  subscription_id = var.subscription_id
  client_id       = var.client_id
  client_secret   = var.client_secret
  tenant_id       = var.tenant_id
  features {}
}

# Resource Group
resource "azurerm_resource_group" "rg" {
  name     = "${var.name_prefix}-terraform-rg"
  location = var.location
}

# Application Insights
resource "azurerm_application_insights" "ai" {
  name                = "${var.name_prefix}-gridbotapi-ai"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  application_type    = "web"
}

output "instrumentation_key" {
  value = azurerm_application_insights.ai.instrumentation_key
  sensitive = true
}

output "app_id" {
  value = azurerm_application_insights.ai.app_id
}

# Key Vault
data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "kv" {
  name                        = "${var.name_prefix}-kv"
  location                    = azurerm_resource_group.rg.location
  resource_group_name         = azurerm_resource_group.rg.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = true

  sku_name = "standard"

  access_policy {
    tenant_id          = data.azurerm_client_config.current.tenant_id
    object_id          = data.azurerm_client_config.current.object_id

    key_permissions    = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify", "GetRotationPolicy"]
    secret_permissions = ["Get", "Set"]
  }
}

output "tenant_id" {
    value = data.azurerm_client_config.current.tenant_id
}

output "object_id" {
    value = data.azurerm_client_config.current.object_id
}

resource "azurerm_key_vault_secret" "ai_connection_string" {
  name         = "ApplicationInsightsConnectionString"
  value        = "InstrumentationKey=${azurerm_application_insights.ai.instrumentation_key};IngestionEndpoint=https://westeurope-4.in.applicationinsights.azure.com/;LiveEndpoint=https://westeurope.livediagnostics.monitor.azure.com/"
  key_vault_id = azurerm_key_vault.kv.id
}

# Azure App Configuration
resource "azurerm_app_configuration" "appconfiguration" {
  name                = "${var.name_prefix}-appconfiguration"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "standard"
}

resource "azurerm_app_configuration_key" "ai_connection_string" {
  configuration_store_id = azurerm_app_configuration.appconfiguration.id
  key                    = "ApplicationInsights:ConnectionString"
  value                  = "@Microsoft.KeyVault(SecretUri=${azurerm_key_vault_secret.ai_connection_string.id})"
}

编辑

waiting for App Configuration Key "ApplicationInsights:ConnectionString" read permission to be propagated: timeout while waiting for state to become 'Error, Exists, NotFound' (last state: 'Forbidden',│ timeout: 1m58.1932854s)

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.65.0"
    }
  }
}

provider "azurerm" {
  subscription_id = var.subscription_id
  client_id       = var.client_id
  client_secret   = var.client_secret
  tenant_id       = var.tenant_id
  features {}
}

# Resource Group
resource "azurerm_resource_group" "rg" {
  name     = "${var.name_prefix}-terraform-rg"
  location = var.location
}

# Application Insights
resource "azurerm_application_insights" "ai" {
  name                = "${var.name_prefix}-gridbotapi-ai"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  application_type    = "web"
}

output "instrumentation_key" {
  value = azurerm_application_insights.ai.instrumentation_key
  sensitive = true
}

output "app_id" {
  value = azurerm_application_insights.ai.app_id
}

# Key Vault
data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "kv" {
  name                        = "${var.name_prefix}-kv"
  resource_group_name         = azurerm_resource_group.rg.name
  location                    = azurerm_resource_group.rg.location
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = true

  sku_name = "standard"

  access_policy {
    tenant_id          = data.azurerm_client_config.current.tenant_id
    object_id          = data.azurerm_client_config.current.object_id

    key_permissions    = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify", "GetRotationPolicy"]
    secret_permissions = ["Get", "Set"]
  }
}

output "tenant_id" {
    value = data.azurerm_client_config.current.tenant_id
}

output "object_id" {
    value = data.azurerm_client_config.current.object_id
}

resource "azurerm_key_vault_secret" "ai_connection_string" {
  name         = "ApplicationInsightsConnectionString"
  value        = azurerm_application_insights.ai.connection_string
  key_vault_id = azurerm_key_vault.kv.id
}

# Azure App Configuration
resource "azurerm_app_configuration" "appconf" {
  name                = "${var.name_prefix}-appconf"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  sku                 = "standard"
}

resource "azurerm_role_assignment" "appconf_dataowner" {
  scope                = azurerm_app_configuration.appconf.id
  role_definition_name = "App Configuration Data Owner"
  principal_id         = data.azurerm_client_config.current.object_id
}

resource "azurerm_app_configuration_key" "ai_connection_string" {
  configuration_store_id = azurerm_app_configuration.appconf.id
  key                    = "ApplicationInsights:ConnectionString"
  value                  = "@Microsoft.KeyVault(SecretUri=${azurerm_key_vault_secret.ai_connection_string.id})"

  depends_on = [
    azurerm_role_assignment.appconf_dataowner
  ]

  timeouts {
    create = "2m"
  }
}

Answer 1

您必须将运行 Terraform 的身份的“应用程序配置数据所有者”角色分配给应用程序配置资源的范围或任何父范围，因为应用程序配置 key 是使用数据平面 API 进行配置的，根据提供商文档(我也验证了它):

> 注意:应用程序配置 key 是使用数据平面 API 进行配置的，该 API 需要应用程序配置或父范围(例如资源组/订阅)上的应用程序配置数据所有者角色。可以在 Azure 应用程序配置文档中找到更多信息。

如果这有帮助，请投票/接受答案。

有关配置的提示:您可以直接引用 App Insights 的 connection_string，而不是连接其值，因为它是由资源本身导出的:

resource "azurerm_key_vault_secret" "ai_connection_string" {
 name         = "ApplicationInsightsConnectionString"
 value        = azurerm_application_insights.ai.connection_string
 key_vault_id = azurerm_key_vault.kv.id
}