Container-Man's questions

我的目标是使用 Terraform 实现以下 URL。

ec2-environment1-region1.special.myurl.com
ec2-environment2-region1.special.myurl.com
ec2-environment3-region1.special.myurl.com
ec2-environment4-region2.myurl.com
ec2-environment5-region3.myurl.com

我使用了连接功能。下面是代码。

join(".", ["ec2-${var.env}-${var.region}", var.region == "region1" ? "special" : null, "myurl.com"])

因此，当我传递var.region == "region1"URL 时，它会正确创建，如下所示：

ec2-environment1-region1.special.myurl.com

但是，如果我传递其他内容而不是region1它var.region，则会出现以下错误。

Invalid value for "lists" parameter: element 1 is null; cannot concatenate null values.

我们使用 Azure 作为 Terraform 代码的后端。下面是代码。

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.40.0"
    }
  }

  backend "azurerm" {
    resource_group_name  = "test"
    storage_account_name = "test"
    container_name       = "test"
    key                  = "test.tfstate"
    tenant_id            =  "abc"
  }
}

provider "azurerm" {
  features {}
  alias               = "new-new"
  subscription_id     = var.another_subscription
}

provider "azurerm" {
  features {}
}

我已使用以下命令以服务主体用户身份登录：

az login --service-principal -t tenant-id-here -u object-id-of-sp -p client-secret-of-sp

当我terraform init这样做时，会出现以下错误：

Initializing the backend...
╷

    │ Error: Error building ARM Config: Authenticating using the Azure CLI is only supported as a User (not a Service Principal).
    │ 
    │ To authenticate to Azure using a Service Principal, you can use the separate 'Authenticate using a Service Principal'
    │ auth method - instructions for which can be found here: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/service_principal_client_secret
    │ 
    │ Alternatively you can authenticate using the Azure CLI by using a User Account.

变量.tf

variable "custom_ids" {
  type    = set(string)
  default = ["b4d2d", "c928f140e8"]
}

主.tf

resource "azuread_application" "my-test-app" {
  for_each     = var.custom_ids
  display_name = "testing-application"
  owners       = [data.azuread_client_config.current.object_id , each.value ] 
}

resource "azuread_service_principal" "testing-sp" {
  for_each                     = azuread_application.my-test-app
  application_id               = azuread_application.my-test-app.application_id
  app_role_assignment_required = false
  owners                       = [data.azuread_client_config.current.object_id , each.value]
}

错误消息是：

错误：缺少资源实例键 由于 azuread_application.my-test-app 设置了“for_each”，因此必须在特定实例上访问其属性。│ │ 例如，要与引用资源的索引相关联，请使用： │ azuread_application.my-test-app[each.key]

提到这个：https://developer.hashicorp.com/terraform/language/meta-arguments/for_each#chaining-for_each- Between-resources

这里有什么问题？

新错误：

│ 错误：不支持的属性 │ │ my-service-principals.tf 第 24 行，资源“azure_service_principal”“testing-sp”中： │ 24: application_id = every.value.application_id │ ├───────── ──────── │ │ every.value 是一组字符串 │ │ 该值没有任何属性。

我正在尝试使用 Terraform 在 AD 中创建 Azure 应用程序。

resource "azuread_application" "my_ad_app" {
  display_name = "my_app"

  #API Permissions
  required_resource_access {
    resource_app_id = "0000000-000000000000" # Microsoft Graph

    resource_access {
      id   = "df021288-bdef-9214" # User.Read.All
      type = "Role"
    }

    resource_access {
      id   = "18a4783c662c884" # User.Read.All
      type = "Role"
    }

    resource_access {
      id   = "9a5d68c3a30" # Application.Read.All
      type = "Role"
    }

我将创建更多 Azure AD 应用程序并分配相同的 API 权限。将分配许多 API 权限，它们对于我将创建的所有 Azure AD 应用程序都是相同的。由于我将为其创建的所有 Azure AD 应用程序的 API 权限都是相同的，因此我想将整个应用程序分配required_resource_access为变量。

像这样的东西。

#API Permissions
  required_resource_access {
    resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph

    resource_access {
     assign the entire part as a variable here? Example: var.ms_graph_api_permission
     }

我尝试将以下内容添加为变量，但似乎不起作用。

variable "ms_graph_api_permission" {
  type = list(string)
  default =

resource_access {
id   = "df021288f22de89214" 
type = "Role"
}

resource_access {
id   = "18a4783e5662c884" 
type = "Role"
}

resource_access {
id   = "9a5d68ac3a30" 
type = "Role"
}
}"

这似乎不起作用。知道如何自动化吗？

我尝试使用当地人。

locals {
  resource_access = [
    {
      id   = "df021288-bdde89214" # User.Read.All
      type = "Role"
    },
    {
      id   = "18a4783c-85e5662c884" # User.Read.All
      type = "Role"
    }
  ]
}

resource "azuread_application" "my_ad_app" {
  display_name = "my_app"

  #API Permissions
  required_resource_access {
    for_each   = {
    for index, az_app_id in local.resource_access:
    az_app_id.id => az_app_id
    }

    resource_app_id = "000000000000" # Microsoft Graph

    resource_access = How should I pass values here using locals??