Terraform - azurerm_frontdoor_custom_https_configuration - “给定的键无法识别此集合值中的元素”

Question

• 这段代码之前已经工作过，我想做的就是添加新的前端端点、路由规则、后端池
• 我尝试只分享我认为相关的代码片段，但如果您需要缺少一些关键信息，请告诉我

这个错误已经困扰了我几天，无论我尝试了什么，我似乎都无法理解这个错误。它就像从变量中索引或搜索不存在的东西，但已经有类似 6 的东西，现在我正在添加另一个。

我担心这个前门代码已经有一段时间没有运行了，并且状态有些问题。特别是考虑到此资源附带的 TF 文档上的所有警报 - https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/frontdoor_custom_https_configuration

已经有一段时间了，AzureRM 版本经历了多次更新 - 可能从之前的 2.58 到现在的 2.58。我想我也不知道如何验证/查看状态文件并确保其正确 - 即使查看 2.58 升级说明它也令人困惑。

想法？

错误

on ..\modules\frontdoor\main.tf line 129, in resource "azurerm_frontdoor_custom_https_configuration" "https_config":
 129:   frontend_endpoint_id              = azurerm_frontdoor.main.frontend_endpoints[each.value]
    |----------------
    | azurerm_frontdoor.main.frontend_endpoints is map of string with 8 elements
    | each.value is "www-sell-dev-contoso-com"

The given key does not identify an element in this collection value.

main.tf

provider "azurerm" {
  features {}
}
terraform {
  backend "azurerm" {
  }
}

#the outputs.tf on this module output things like the frontdoor_endpoints
#the outputs.tf with main.tf also output similar values

module "coreInfraFrontDoor" {
  source                                       = "../modules/frontdoor"
  resource_group_name                          = module.coreInfraResourceGroup.resource_group_name
  frontdoor_name                               = "fd-infra-${terraform.workspace}-001"
  enforce_backend_pools_certificate_name_check = lookup(var.enforce_backend_pools_certificate_name_check, terraform.workspace)
  log_analytics_workspace_id                   = module.coreInfraLogAnalytics.log_analytics_workspace_id
  tags                                         = local.common_tags
  health_probes                                = lookup(var.health_probes, terraform.workspace)
  routing_rules                                = lookup(var.routing_rules, terraform.workspace)
  backend_pools                                = lookup(var.backend_pools, terraform.workspace)
  frontend_endpoints                           = lookup(var.frontend_endpoints, terraform.workspace)
  prestage_frontend_endpoints                  = lookup(var.prestage_frontend_endpoints, terraform.workspace)
  frontdoor_firewall_policy_name               = "fdfwp${terraform.workspace}001"
  frontdoor_firewall_prestage_policy_name      = "fdfwp${terraform.workspace}prestage"
  mode                                         = lookup(var.mode, terraform.workspace)
  ip_whitelist_enable                          = lookup(var.ip_whitelist_enable, terraform.workspace)
  ip_whitelist                                 = lookup(var.ip_whitelist, terraform.workspace)
  key_vault_id                                 = module.coreInfraKeyVault.id
}

模块 main.tf

resource "azurerm_frontdoor" "main" {
  name                                         = var.frontdoor_name
  location                                     = "global"
  resource_group_name                          = var.resource_group_name
  enforce_backend_pools_certificate_name_check = var.enforce_backend_pools_certificate_name_check
  tags                                         = var.tags

dynamic "routing_rule {#stuff is here obv}
dynamic "backend_pool {#also here}

#i think this is because there was an issue/needs to be some default value for the first endpoint?
frontend_endpoint {
    name                                    = var.frontdoor_name
    host_name                               = "${var.frontdoor_name}.azurefd.net"
    web_application_firewall_policy_link_id = azurerm_frontdoor_firewall_policy.main.id
  }

#now the dynamic ones from vars
dynamic "frontend_endpoint" {
    for_each = var.frontend_endpoints
    content {
      name                                    = frontend_endpoint.value.name
      host_name                               = frontend_endpoint.value.host_name
      session_affinity_enabled                = lookup(frontend_endpoint.value, "session_affinity_enabled", false)
      web_application_firewall_policy_link_id = azurerm_frontdoor_firewall_policy.main.id
    }
  }

版本.tf

terraform {
  required_version = "~> 0.14.7"
  required_providers {
    azurerm = "~>2.72.0"
  }
}

变量.tf

variable "frontend_endpoints" {
  type        = map(any)
  description = "List of frontend (custom) endpoints. This is in addition to the <frontend_name>.azurefd.net endpoint that this module creates by default."

  default = {
    dev = [
      {
        name         = "dev-search-contoso-com"
        host_name    = "dev.search.contoso.com"
      },
      {
        name         = "dev-cool-contoso-com"
        host_name    = "dev.cool.contoso.com"
      },
      ########################
      #this is new below
      ########################
      {
        name         = "dev-sell-contoso-com"
        host_name    = "dev.sell.contoso.com"
      }
   ]
   prod = [ #you get the idea ]
  }

Answer 1

在向现有前门添加端点时，我自己也遇到了同样的问题，并从 this Terrafrom 文章中找到了以下修复。

基本上，不调用集合，而是直接生成 id，如下所示：

“${azurerm_frontdoor.example.id}/frontendEndpoints/[端点名称]”

其中 [endpont name] 来自相关 frontend_endpoint 资源中的 name 元素。

resource "azurerm_frontdoor_custom_https_configuration" "default" {
  frontend_endpoint_id              = "${azurerm_frontdoor.example.id}/frontendEndpoints/${local.default_frontend_name }"

  custom_https_provisioning_enabled = false
}

resource "azurerm_frontdoor_custom_https_configuration" "custom" {
  frontend_endpoint_id              = "${azurerm_frontdoor.example.id}/frontendEndpoints/${local.custom_frontend_name}"
  custom_https_provisioning_enabled = true

  custom_https_configuration {
  certificate_source = "FrontDoor"
  }
} 

从来没有弄清楚为什么它没有在集合中。但这似乎工作正常。