Matty's questions

我正在尝试创建自定义 WAF 规则以允许流量到特定的 URI - 此部署是通过 Terraform 完成的。

我收到的错误是：

Application Gateway Web Application Firewall Policy Name: "waf-policy-prod-uksouth"): unexpected status 400 (400 Bad Request) with error: ApplicationGatewayFirewallMatchValueNoCollection: Custom Rule 'AllowAmexPay' does not have a valid collection match variable 'RequestUri' which support selector in its condition in context 'properties.customRules[2].matchConditions[0].matchVariables[0]'.
│ 
│   with azurerm_web_application_firewall_policy.waf_policy,
│   on application_gw.tf line 224, in resource "azurerm_web_application_firewall_policy" "waf_policy":
│  224: resource "azurerm_web_application_firewall_policy" "waf_policy" {

TFVars 文件：

custom_rules = [
    {
        name                    = "RecitePreferences"
        priority                = "70"
        enabled                 = true
        rule_type               = "MatchRule"
        variable_name           = "RequestCookies"
        selector                = "Recite.Preferences"
        operator                = "Any"
        action                  = "Allow"
    },
        {
        name                    = "CookieConsent"
        priority                = "71"
        enabled                 = true
        rule_type               = "MatchRule"
        variable_name           = "RequestCookies"
        selector                = "CookieConsent"
        operator                = "Any"
        action                  = "Allow"
    },
        {
        name                    = "AllowAmexPay"
        priority                = "80"
        enabled                 = true
        rule_type               = "MatchRule"
        variable_name           = "RequestUri"
        selector                = "/smart-card/amex-pay"
        operator                = "Contains"
        action                  = "Allow"
    },
        {
        name                    = "AllowAmexPayComplete"
        priority                = "81"
        enabled                 = true
        rule_type               = "MatchRule"
        variable_name           = "RequestUri"
        selector                = "/smart-card/amex-pay-complete"
        operator                = "Contains"
        action                  = "Allow"
    }
]

Variables.tf 文件：

variable "custom_rules" {
  type  = list(object({
    name                    = string
    priority                = string
    enabled                 = bool
    rule_type               = string
    variable_name           = string
    operator                = string
    selector                = string
    action                  = string
  }))
}

应用程序网关配置：

resource "azurerm_web_application_firewall_policy" "waf_policy" {
  name                = "waf-policy-${var.general_environment}-${var.general_location}"
  resource_group_name = azurerm_resource_group.prod.name
  location            = azurerm_resource_group.prod.location

  policy_settings {
    enabled                     = true
    mode                        = "Detection"
    request_body_check          = false
    file_upload_limit_in_mb     = 100
    max_request_body_size_in_kb = 128
  }
  managed_rules {
    managed_rule_set {
      type    = "OWASP"
      version = "3.2"
      
      dynamic "rule_group_override" {
        for_each = var.rule_group_override
        content {
          rule_group_name = rule_group_override.key

          dynamic "rule" {
            for_each = rule_group_override.value
            content {
            id      = rule.value.id
            enabled = rule.value.enabled
          } 
        }
      }
    }
  }

    dynamic "exclusion" {
      for_each = var.exclusion

      content {
        match_variable          = exclusion.value["match_variable"]
        selector                = exclusion.value["selector"]
        selector_match_operator = exclusion.value["selector_match_operator"]
      }
    }
    managed_rule_set {
      type = "Microsoft_BotManagerRuleSet"
      version = "1.0"
    }
  }
    dynamic "custom_rules" {
      for_each = var.custom_rules

      content {
          name          = custom_rules.value["name"]
          enabled       = custom_rules.value["enabled"]
          priority      = custom_rules.value["priority"]
          rule_type     = custom_rules.value["rule_type"]
          action        = custom_rules.value["action"]
          match_conditions {
            operator     = custom_rules.value["operator"]
            match_variables {
              variable_name = custom_rules.value["variable_name"]
              selector      = custom_rules.value["selector"]
            }
          }
        } 
      }     
}

只是想知道是否有不同/更好的方法来传递变量，因为这些变量目前在 Apply 上出错？

我正在尝试通过 Terraform 设置从 Key Vault 到 SQL 服务器的用户名和密码数据查找。我有 3 个环境：开发、UAT 和生产，每个环境都有不同的凭据。每个环境都有一个var.environment变量，该变量在环境 .tfvars 文件中设置。我已经将机密添加到 Key Vault 中，并通过数据源访问这些机密。

我考虑过使用 If OR，但我只能通过它设置 2 个值。

我也研究过使用 locals 和 tomap 的方法，比如

locals{
  username = tomap({
    devusername = data.azurerm_key_vault_secret.username.value
    devpassword = data.azurerm_key_vault_secret.password.value
  })
}

administrator_login = local.username[var.environment]

data "azurerm_key_vault_secret" "dev-username" {
  name         = "sql-username"
  key_vault_id = data.azurerm_key_vault.kv.id
}

环境变量设置在 tfvars 级别（每个环境一个）

variable "environment" {
  type = string
}

然而，您似乎无法将数据值放入映射中，只是想知道是否还有其他方法可以为每个环境设置用户名/密码。