Terraform ARM模板由于没有唯一ID而失败

Question

我使用以下Terraform ARM模板部署到Azure Stack：...

resource "azurestack_template_deployment" "nsg-rule1" {
  count = "${var.nsgr_map["nsg_sourceportranges"] == "" && var.nsgr_map["nsg_destinationportranges"] == "" && var.nsgr_map["nsg_sourceaddressprefixes"] == "" && var.nsgr_map["nsg_destinationaddressprefixes"] == "" ? 1 : 0}"
  name                = "${var.nsgr_map["nsg_rulename"]}"
  resource_group_name = "${var.nsgr_map["rsg_name"]}"

  template_body = <<DEPLOY
{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "networkSecurityGroupName": {
            "type": "String"
        },
        "networkSecurityGroupRuleName": {
            "type" : "String"
        }, 
        "protocol" : {
            "type" : "String"
        },
        "sourcePortRange": {
            "type" : "String"
        },
        "destinationPortRange": {
            "type" : "String"
        },
        "sourceAddressPrefix" : {
            "type" : "String"
        },
        "destinationAddressPrefix" : {
            "type" : "String"
        },
        "access" : {
            "type" : "String"
        },
        "priority" : {
            "type" : "String"
        },
        "direction" : {
            "type" : "String"
        },
        "sourcePortRanges" : {
            "type" : "String"
        },
        "destinationPortRanges" : {
            "type" : "String"
        },
        "sourceAddressPrefixes" : {
            "type" : "String"
        },
        "destinationAddressPrefixes" : {
            "type" : "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Network/networkSecurityGroups/securityRules",
            "apiVersion": "2017-10-01",
            "name": "[concat(parameters('networkSecurityGroupName'),'/',parameters('networkSecurityGroupRuleName'))]",
            "properties": {
                "protocol": "[parameters('protocol')]",
                "sourcePortRange": "[parameters('sourcePortRange')]",
                "destinationPortRange": "[parameters('destinationPortRange')]",
                "sourceAddressPrefix": "[parameters('sourceAddressPrefix')]",
                "destinationAddressPrefix": "[parameters('destinationAddressPrefix')]",
                "access": "[parameters('access')]",
                "priority": "[parameters('priority')]",
                "direction": "[parameters('direction')]",
                "sourcePortRanges": "[parameters('sourcePortRanges')]",
                "destinationPortRanges": "[parameters('destinationPortRanges')]",
                "sourceAddressPrefixes": "[parameters('sourceAddressPrefixes')]",
                "destinationAddressPrefixes": "[parameters('destinationAddressPrefixes')]"
            }
        }
    ]
}
DEPLOY

  # these key-value pairs are passed into the ARM Template's `parameters` block
  parameters = {
    networkSecurityGroupName = "${var.nsgr_map["nsg_name"]}"
    networkSecurityGroupRuleName = "${var.nsgr_map["nsg_rulename"]}"
    protocol = "${var.nsgr_map["nsg_protocol"]}"
    sourcePortRange = "${var.nsgr_map["nsg_source_portrange"]}"
    destinationPortRange = "${var.nsgr_map["nsg_destination_portrange"]}"
    sourceAddressPrefix ="${var.nsgr_map["nsg_sourceaddressprefix"]}"
    destinationAddressPrefix = "${var.nsgr_map["nsg_destinationaddressprefix"]}"
    access = "${var.nsgr_map["nsg_access"]}"
    priority = "${var.nsgr_map["nsg_priority"]}"
    direction = "${var.nsgr_map["nsg_direction"]}"
    sourcePortRanges = ""
    destinationPortRanges = ""
    sourceAddressPrefixes = ""
    destinationAddressPrefixes = ""
  }

  deployment_mode = "Incremental"
}

...

实际上，我想将一些NSG规则添加到Azure Stack上的现有网络安全组（NSG）。问题是，如果我在同一资源组下部署具有相同名称的不同规则，则部署将失败，因为NSG并不是ID（标识要创建的资源）的一部分。

换句话说，我有两个具有相同名称的规则-在资源组'NSG_Rule_Open_VPN'下说'Virtual_Network_1'，但对于两个不同的网络安全组'nsg_1'和'nsg_2'。然后，部署失败并出现错误，因为Terraform两次部署了相同的资源（但是目标NSG并不相同）

如果我查看Azure Stack上的活动协议，很明显Terraform不在ID中使用目标NSG的名称来创建资源：

"resourceId": "/subscriptions/yyyxxx/resourcegroups/RSG_99_VirtualNetwork_01/providers/Microsoft.Resources/deployments/NSR_out_TCP_allow_VMtoINTERNET-HTTPS",

它仅使用资源组名称'RSG_99_VirtualNetwork_01'和规则名称'NSR_out_TCP_allow_VMtoINTERNET-HTTPS'，而不使用NSG名称。

是否有避免这种情况的方法。这样Terraform会创建一个resourceID，它也依赖于NSG名称？

Answer 1

之所以发生，是因为这是部署名称，而不是NSG规则名称。因此，您需要更新此位以包含nsg-name或一些计数器或随机数：

resource "azurestack_template_deployment" "nsg-rule1" {
  count = not_important_removed
  name                = "${var.nsgr_map["nsg_rulename"]}" # this bit needs to be updated
  resource_group_name = "${var.nsgr_map["rsg_name"]}"