Terraform中data azuread_users是否支持空值？传null配置PIM报错

问题描述 #

执行Terraform代码时触发必填参数缺失错误：

│ Error: Missing required argument │
│   with module.entragroups.azuread_privileged_access_group_eligibility_schedule.eligible-pim-assignment["group_01"],
│   on .terraform/modules/entragroups/entra/groups/main.tf line 53, in resource "azuread_privileged_access_group_eligibility_schedule" "eligible-pim-assignment":
│   53:   principal_id    = try(data.azuread_users.eligible-pim-users[each.key].object_ids[0], null)
│
│ The argument "principal_id" is required, but no definition was fou

相关代码片段如下：

资源定义 #

resource "azuread_privileged_access_group_eligibility_schedule" "eligible-pim-assignment" {
  for_each        = var.entra_groups
  group_id        = azuread_group.group[each.key].object_id
  principal_id    = try(data.azuread_users.eligible-pim-users[each.key].object_ids[0], null)
  assignment_type = each.value.assignment_type
  justification        = each.value.justification
  start_date           = each.value.start_date
  expiration_date      = each.value.expiration_date
  permanent_assignment = each.value.permanent_assignment_active
}

数据源定义 #

data "azuread_users" "eligible-pim-users" {
  for_each             = var.entra_groups
  user_principal_names = each.value.eligible_pim_assignment_users
  ignore_missing       = true
}

变量与示例配置 #

variable "entra_groups" {
  description = "entra groups"
  type = map(object({
    display_name                  = string
    security_enabled              = optional(bool)
    assignable_to_role            = optional(bool)
    security_group_owners         = optional(list(string), [])
    active_pim_assignment_spn     = optional(list(string), [])
    assignment_type               = optional(string)
    duration                      = optional(string)
    eligible_pim_assignment_users = optional(list(string), [])
    active_pim_assignment_users   = optional(list(string), [])
    permanent_assignment_schedule = optional(bool)
    permanent_assignment_active   = optional(bool)
    justification                 = optional(string)
    start_date                    = optional(string)
    expiration_date               = optional(string)
  }))
  default = {}
}

group_01 = {
  display_name                  = "test"
  description                   = ""
  security_enabled              = true
  assignable_to_role            = true
  active_pim_assignment_spn     = []
  assignment_type               = "member"
  duration                      = ""
  eligible_pim_assignment_users = []
  active_pim_assignment_users   = []
  permanent_assignment_schedule = false
  start_date                    = "2025-03-07T01:02:03Z"
  expiration_date               = "2026-03-01T01:02:03Z"
  permanent_assignment_active   = true
  justification                 = "as requested"
}

解答 #

1. data azuread_users 是否支持接收null值？ #

data azuread_users 的 user_principal_names 参数不支持直接传入null，但可以接收空列表。结合 ignore_missing = true 配置时，空列表会返回空的 object_ids 集合，不会触发数据源报错。

2. 报错解决方法 #

报错核心是 azuread_privileged_access_group_eligibility_schedule 资源的 principal_id 为必填参数，不能传入null。当 eligible_pim_assignment_users 为空列表时，object_ids[0] 会返回null，try 语句最终返回null，违反必填要求。

推荐以下解决方法：

方法一：仅在有用户时创建PIM分配

修改资源和数据源的 for_each 逻辑，只遍历包含有效用户列表的组，避免创建无目标用户的无效分配：

# 优化后的资源定义
resource "azuread_privileged_access_group_eligibility_schedule" "eligible-pim-assignment" {
  for_each = {
    for k, v in var.entra_groups : k => v
    if length(v.eligible_pim_assignment_users) > 0
  }
  group_id        = azuread_group.group[each.key].object_id
  principal_id    = data.azuread_users.eligible-pim-users[each.key].object_ids[0]
  assignment_type = each.value.assignment_type
  justification        = each.value.justification
  start_date           = each.value.start_date
  expiration_date      = each.value.expiration_date
  permanent_assignment = each.value.permanent_assignment_active
}

# 优化后的数据源定义
data "azuread_users" "eligible-pim-users" {
  for_each = {
    for k, v in var.entra_groups : k => v
    if length(v.eligible_pim_assignment_users) > 0
  }
  user_principal_names = each.value.eligible_pim_assignment_users
  ignore_missing       = true
}

方法二：特殊场景下设置默认值（不推荐）

如果业务强制要求必须创建该资源，可设置一个无效的默认Principal ID，但此方法会导致AzureAD API调用失败，仅适用于测试或特殊兼容场景：

principal_id    = try(data.azuread_users.eligible-pim-users[each.key].object_ids[0], "00000000-0000-0000-0000-000000000000")

内容的提问来源于stack exchange，提问作者SRE