azure - 使用 Azure Policy 和 Terraform 模板进行标记忽略标签

Question

我正在努力实现以下目标:

• 使用生命周期命令忽略 Azure 策略应用于资源的标签。

背景我有一个 terraform 模板，它将标签应用于资源组，但同一模板中的资源没有应用标签。相反，我有一个 Azure 策略，强制从资源组继承标签。

当我对模板进行任何更改并运行terraform plan时，我会发生大量更改，这些更改状态会将标签从值更改为空。这不会引起任何问题；它只是通过不必要的更改使我的地形计划变得臃肿。

问题我尝试使用 lifecycle 命令来表示忽略更改并将值设置为标签，但它似乎不起作用，并且计划仍然显示标签将被删除。

下面是一个资源示例，表明如果发生更改，标签将被删除。

示例代码

resource "azurerm_virtual_machine_extension" "ext_ade" {
   depends_on = [azurerm_virtual_machine_extension.ext_domain_join, azurerm_virtual_machine_extension.ext_dsc]
   count = var.session_hosts.quantity
    name = var.ext_ade.name  
    virtual_machine_id = azurerm_windows_virtual_machine.vm.*.id[count.index]
    publisher = "Microsoft.Azure.Security"
    type = "AzureDiskEncryption"
    type_handler_version = "2.2"
    auto_upgrade_minor_version = true

    settings = <<SETTINGS
    {
        "EncryptionOperation": "EnableEncryption",
        "KeyVaultURL": "${data.azurerm_key_vault.key_vault.vault_uri}",
        "KeyVaultResourceId": "${data.azurerm_key_vault.key_vault.id}",
        "KeyEncryptionKeyURL": "${azurerm_key_vault_key.ade_key.*.id[count.index]}",
        "KekVaultResourceId": "${data.azurerm_key_vault.key_vault.id}",
        "KeyEncryptionAlgorithm": "RSA-OAEP",
        "VolumeType": "All"
    }
    SETTINGS

    lifecycle {
      ignore_changes = [settings,tags]
    }
}

Answer 1

Tagging using Azure Policy and Terraform templates ignoring tags

我已经在我的环境中进行了尝试，并且能够使用 lifecycle 命令成功部署它。

取自 SO 的 Terraform 片段@Jim Xu 给出的解决方案并对其进行修改以满足您的要求，如下所示:

ma​​in.tf

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.99.0"
    }
  }
}
provider "azurerm" {
        features {}

}
resource "random_string" "password" {
  length  = 16
  special = false
}
data "azurerm_resource_group" "newtest" {
  name = var.resource_group_name
}
resource "azurerm_key_vault" "keyvault" {
  name                = var.key_vault_name
  resource_group_name = var.resource_group_name
   enabled_for_disk_encryption = true
   enabled_for_deployment=true
   enabled_for_template_deployment =true
   location=data.azurerm_resource_group.newtest.location
   tenant_id = "<tenant-id>"
   sku_name = "standard"
   soft_delete_retention_days=90
   
}
resource "azurerm_key_vault_access_policy" "myPolicy" {
  key_vault_id = azurerm_key_vault.keyvault.id
  tenant_id = "<tenant-id>"
  object_id = "<object-id>"
  key_permissions = [
    "Create",
    "Delete",
    "Get",
    "Purge",
    "Recover",
    "Update",
    "List",
    "Decrypt",
    "Sign"
  ]
}

resource "azurerm_key_vault_key" "testKEK" {
  name         = "testKEK"
  key_vault_id = azurerm_key_vault.keyvault.id
  key_type     = "RSA"
  key_size     = 2048
   depends_on = [
    azurerm_key_vault_access_policy.myPolicy
  ]
  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
}
 
resource "azurerm_virtual_machine_extension" "vmextension" {
  name                       = random_string.password.result
  virtual_machine_id         = "/subscriptions/<subscription_ID>/resourceGroups/<resourceGroup>/providers/Microsoft.Compute/virtualMachines/<VMName>"
  publisher                  = "Microsoft.Azure.Security"
  type                       = "AzureDiskEncryption"
  type_handler_version       = var.type_handler_version
  auto_upgrade_minor_version = true

  settings = <<SETTINGS
    {
        "EncryptionOperation": "${var.encrypt_operation}",
        "KeyVaultURL": "${azurerm_key_vault.keyvault.vault_uri}",
        "KeyVaultResourceId": "${azurerm_key_vault.keyvault.id}",                   
        "KeyEncryptionKeyURL": "${azurerm_key_vault_key.testKEK.id}",
        "KekVaultResourceId": "${azurerm_key_vault.keyvault.id}",                   
        "KeyEncryptionAlgorithm": "${var.encryption_algorithm}",
        "VolumeType": "${var.volume_type}"
    }
SETTINGS

 lifecycle {
      ignore_changes = [settings,tags]
    } 
}

变量.tf:

variable "resource_group_name" {
  default     = "newtest"
}
variable "location" {
  default     = "EastUS"
}
variable key_vault_name {
  default     = ""
}
variable virtual_machine_id {
    default     = ""
}
variable "volume_type" {
  default = "All"
}
variable "encrypt_operation" {
  default = "EnableEncryption"
}
variable "type_handler_version" {
  description = "Defaults to 2.2 on Windows"
  default     = "2.2"
}

注意:您可以修改 tfvars 文件以满足您的需要。

已执行 terraform init 或 terraform init -upgrade:

已执行 terraform计划:

给出 terraform apply 成功运行上述命令后:

从 Portal 创建 key 保管库并观察到没有任何变化:

门户中部署的资源组(newtest):