Terraform配置Azure应用网关WAF多规则覆盖遇重复组错误解决

问题现象 #

通过CI/CD流水线部署Terraform代码时，触发400错误，提示规则组覆盖重复定义：

│ Error: creating Application Gateway Web Application Firewall Policy (Subscription: "XXXX-XXXX-XXXX-XXXX"
│ Resource Group Name: "rg-appgw-prod-uks"
│ Application Gateway Web Application Firewall Policy Name: "waf-policy-appgw-prod-uksouth"): unexpected status 400 (400 Bad Request) with error: ApplicationGatewayFirewallDuplicateRuleGroupOverride: The override RuleGroup 'REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION' is defined more than once for Application Gateway Firewall in context '/subscriptions/XXXX-XXXX-XXXX-XXXX-XXXX/resourceGroups/rg-appgw-prod-uks/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/waf-policy-appgw-prod-uksouth'.
│ 
│   with azurerm_web_application_firewall_policy.waf_policy,
│   on application_gw.tf line 101, in resource "azurerm_web_application_firewall_policy" "waf_policy":
│  101: resource "azurerm_web_application_firewall_policy" "waf_policy" {

当前配置 #

TFVARS 文件 #

rule_group_override = [
    {
        rule_group_name = "REQUEST-920-PROTOCOL-ENFORCEMENT"
        id              = "920300"
        enabled         = false
    },
    {
        rule_group_name = "REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
        id              = "943100"
        enabled         = false
    },
    {
        rule_group_name = "REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
        id              = "943110"
        enabled         = false
    },
    {
        rule_group_name = "REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
        id              = "943120"
        enabled         = false
    }
]

Variables 定义 #

variable "rule_group_override" {
  type  = list(object({
    rule_group_name = string
    id              = string
    enabled         = bool
  }))
}

应用网关WAF策略配置 #

dynamic "rule_group_override" {
  for_each = var.rule_group_override
  content {
    rule_group_name = rule_group_override.value["rule_group_name"]
    rule {
      id      = rule_group_override.value["id"]
      enabled = rule_group_override.value["enabled"]
    } 
  }
}

问题原因 #

当前配置中，每个规则条目都会生成独立的rule_group_override块，但Azure WAF策略要求同一个规则组的所有规则必须放在同一个rule_group_override块内，重复定义同名规则组会触发API校验报错。

解决方案 #

通过Terraform的groupby函数将规则按rule_group_name分组，每个规则组仅生成一个rule_group_override块，内部嵌套该组下的所有规则。

修改后的WAF策略配置 #

1. 定义本地值对规则进行分组：

locals {
  grouped_rule_overrides = groupby(var.rule_group_override, "rule_group_name")
}

2. 更新动态块逻辑：

dynamic "rule_group_override" {
  for_each = local.grouped_rule_overrides
  content {
    rule_group_name = rule_group_override.key
    dynamic "rule" {
      for_each = rule_group_override.value
      content {
        id      = rule.value.id
        enabled = rule.value.enabled
      }
    }
  }
}

说明 #

• TFVARS文件无需修改，保持原有规则列表格式即可。
• 分组后，同一个规则组的所有规则会被打包到同一个rule_group_override块中，符合Azure API的要求，避免重复定义错误。

内容的提问来源于stack exchange，提问作者Matty