azure - 如何使用 Terraform AzureRm 在同一管理规则中包含多个地址前缀

Question

我正在使用 azurerm_network_manager_admin_rule 资源为虚拟网络管理器资源创建管理规则。我只能在每条规则中传递一个地址前缀。有没有办法在同一规则中使用多个地址前缀？

这是错误消息:

Error: creating Network Manager Admin Rule: (Rule Name "example" / Rule Collection Name "example-rule-collection" / Security Admin Configuration Name "ISD" / Network Manager Name "AzureNetworkManager" / Resource Group "resourceGroup-test"): network.AdminRulesClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="AddressPrefix [1.1.1.1/1,2.2.2.2/2,3.3.3.3/3,4.4.4.4/4] has invalid format."
│
│   with module.avnm.azurerm_network_manager_admin_rule.avnm-security-admin-collection-rule["example"],
│   on ..\..\main.tf line 31, in resource "azurerm_network_manager_admin_rule" "avnm-security-admin-collection-rule":
│   31: resource "azurerm_network_manager_admin_rule" "avnm-security-admin-collection-rule" {
│
│ creating Network Manager Admin Rule: (Rule Name "example" / Rule Collection Name "example-rule-collection" / Security Admin Configuration Name "ISD" / Network Manager Name "AzureNetworkManager" / Resource Group "resourceGroup-test"): network.AdminRulesClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: 
│ autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="AddressPrefix [1.1.1.1/1,2.2.2.2/2,3.3.3.3/3,4.4.4.4/4] has invalid format."

(一些名称和IP地址已从原始错误消息中更改)

Answer 1

使用 azurerm 网络管理器管理规则 资源时，无法在单个管理规则中使用“多个地址前缀” .

或者，您可以创建多个管理规则，每个规则都有一个唯一的地址前缀。

例如:

resource "azurerm_network_manager_admin_rule"  "first-rule" {}
resource "azurerm_network_manager_admin_rule"  "second-rule"{}

根据terraform registry ，可以在目标或源地址 block 内创建多个地址前缀。对示例脚本进行一些更改后，我在我的环境中尝试了它，它对我有用，如下所示。

main.tf:

data "azurerm_subscription" "current" {
}
resource "azurerm_resource_group" "main" {
  name     = "<resourcegroup>"
  location = "EastUs"
}

resource "azurerm_network_manager" "main" {
  name                = "<networkmanager>"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name
  scope {
    subscription_ids = [data.azurerm_subscription.current.id]
  }
  scope_accesses = ["Connectivity", "SecurityAdmin"]
  description    = "network manager"
}

resource "azurerm_network_manager_network_group" "main" {
  name               = "<networkgroup>"
  network_manager_id = azurerm_network_manager.main.id
}

resource "azurerm_network_manager_security_admin_configuration" "example" {
  name               = "<admin-conf>"
  network_manager_id = azurerm_network_manager.main.id
}

resource "azurerm_network_manager_admin_rule_collection" "main" {
  name                            = "<admin-rule-collection>"
  security_admin_configuration_id = azurerm_network_manager_security_admin_configuration.main.id
  network_group_ids               = [azurerm_network_manager_network_group.main.id]
}

resource "azurerm_network_manager_admin_rule" "main" {
  name                     = "<adminrule>"
  admin_rule_collection_id = azurerm_network_manager_admin_rule_collection.main.id
  action                   = "Deny"
  direction                = "Outbound"
  priority                 = 1
  protocol                 = "Tcp"
  source_port_ranges       = ["80", "1024-65535"]
  destination_port_ranges  = ["80"]
  source {
    address_prefix_type = ""
    address_prefix      = "Internet"
  }
   destination {
    address_prefix_type = "IPPrefix"
    address_prefix      = "10.1.0.1"
  }
  destination {
    address_prefix_type = "IPPrefix"
    address_prefix      = "10.0.0.0/24"
  }
  description = "admin rule"
}

执行 terraform init 并使用 terraform验证配置验证:

已执行 terraform计划:

已执行 terraform apply:

在具有多个目标地址前缀的门户中成功部署: