azure-devops - 如果已经通过 Terraform 存在，则避免创建新的 Azure Key Vault secret 版本

Question

Terraform 代码在第一次申请时成功创建了一个 Azure Key Vault secret ，但连续申请后，由于过期时间的变化，它仍在尝试更新 secret 。

resource "azurerm_key_vault_secret" "supportedTen" {
  name         = "supportedTen"
  value        = var.supportedTen
  key_vault_id = azurerm_key_vault.vault.id
  expiration_date = timeadd(timestamp(), "2160h")
  depends_on = [azurerm_key_vault_access_policy.vault]
}

2nd terraform apply onwards-

  # azurerm_key_vault_secret.supportedTenants will be updated in-place
  ~ resource "azurerm_key_vault_secret" "supportedTen" {
      ~ expiration_date = "2021-10-10T19:45:05Z" -> (known after apply)
        id              = "https://uri/secrets/supportedTen/abcde-secret-version"
        key_vault_id    = "/subscriptions/subscriptionid/resourceGroups/resourcegroup--id/providers/Microsoft.KeyVault/vaults/test-kv-dev"
        name            = "supportedTenants"
        tags            = {}
        value           = (sensitive value)
        version         = "abcde-secret-version"
    }

如果过期时间未过期或 secret 版本值不为空(“”)，有什么办法可以设置条件，不更新 azure key vault secret 资源？

Answer 1

您可以使用 lifecycle meta-argument忽略到期日期。

resource "azurerm_key_vault_secret" "supportedTen" {
  name         = "supportedTen"
  value        = var.supportedTen
  key_vault_id = azurerm_key_vault.vault.id
  expiration_date = timeadd(timestamp(), "2160h")
  depends_on = [azurerm_key_vault_access_policy.vault]
}

2nd terraform apply onwards-

  # azurerm_key_vault_secret.supportedTenants will be updated in-place
  ~ resource "azurerm_key_vault_secret" "supportedTen" {
      ~ expiration_date = "2021-10-10T19:45:05Z" -> (known after apply)
        id              = "https://uri/secrets/supportedTen/abcde-secret-version"
        key_vault_id    = "/subscriptions/subscriptionid/resourceGroups/resourcegroup--id/providers/Microsoft.KeyVault/vaults/test-kv-dev"
        name            = "supportedTenants"
        tags            = {}
        value           = (sensitive value)
        version         = "abcde-secret-version"
        lifecycle {
           ignore_changes = [
               not_before_date,
               expiration_date
           ]
        }
    }