Terraform部署Azure Event Hub命名空间遇Unsupported attribute错误

问题描述 #

尝试通过Terraform模块部署带有多个IP规则和子网的Azure Event Hub命名空间时，network_rulesets块出现Unsupported attribute错误，无法将网络规则集正确传递到模块中。

Event Hub命名空间模块代码 #

resource "azurerm_eventhub_namespace" "namespace" {
  name                          = var.event_hub_namespace_name
  location                      = var.location
  resource_group_name           = var.resource_group_name
  sku                           = var.settings.sku
  capacity                      = try(var.settings.capacity, null)
  public_network_access_enabled = try(var.settings.public_network_access_enabled, null)
  minimum_tls_version           = try(var.settings.minimum_tls_version, null)
  tags                          = var.tags
  auto_inflate_enabled          = try(var.settings.auto_inflate_enabled, null)
  dedicated_cluster_id          = try(var.settings.dedicated_cluster_id, null)
  maximum_throughput_units      = try(var.settings.maximum_throughput_units, null)
  zone_redundant                = try(var.settings.zone_redundant, null)

  dynamic "identity" {
    for_each = length(var.identity_ids) == 0 && var.identity_type == "SystemAssigned" ? [var.identity_type] : []
    content {
      type = var.identity_type
    }
  }

  dynamic "identity" {
    for_each = length(var.identity_ids) > 0 || var.identity_type == "UserAssigned" ? [var.identity_type] : []
    content {
      type         = var.identity_type
      identity_ids = length(var.identity_ids) > 0 ? var.identity_ids : []
    }
  }

  dynamic "network_rulesets" {
    for_each = var.settings.network_rulesets != {} && var.settings.network_rulesets != null ? [1] : []
    #iterator = "rules"
    content {
      default_action                 = network_rulesets.value.default_action != "" ? network_rulesets.value.default_action : "Allow"
      trusted_service_access_enabled = network_rulesets.trusted_service_access_enabled != "" ? network_rulesets.trusted_service_access_enabled : true

      dynamic "virtual_network_rule" {
        for_each = each.value.network_rulesets.virtual_network_rule != {} && each.value.network_rulesets.virtual_network_rule != null ? [1] : []
        content {
          subnet_id                                       = virtual_network_rule.value.subnet_id
          ignore_missing_virtual_network_service_endpoint = virtual_network_rule.value.ignore_missing_virtual_network_service_endpoint
        }
      } 

      dynamic "ip_rule" {
        for_each = each.value.network_rulesets.ip_rule != [] && each.value.network_rulesets.value.ip_rule != null ? [1] : []
        content {
          ip_mask = ip_rule.value.ip_mask
          action  = ip_rule.value.action
        }
      } 
    }
  }
}

模块调用代码 #

module "eh-ns" {
  source                   = "../modules/event_hub_namespace"
  event_hub_namespace_name = "event-hub-namespace"
  location                 = var.ea2_location
  resource_group_name      = azurerm_resource_group.rg1.name
  tags                     = merge(local.base_tags, { Component = "Event Hub Namespace" })

  identity_type = "UserAssigned"
  identity_ids  = [azurerm_user_assigned_identity.lab.id]

  settings = {
    sku      = "Basic"
    capacity = 1
    network_rulesets = {
      default_action                 = "Deny"
      trusted_service_access_enabled = true
      virtual_network_rule = [
       {
        subnet_id = "<subnet_id1>"
        ignore_missing_virtual_network_service_endpoint = false
       },
       {
        subnet_id = "<subnet_id2>"
        ignore_missing_virtual_network_service_endpoint = false
       }  
      ]
      ip_rule = [
        {
          ip_mask = "10.xxx.xxx.xxx"
          action  = "Allow"
        },
        {
          ip_mask = "10.xxx.xxx.xxx"
          action  = "Allow"
        },
        {
          ip_mask = "10.xxx.xxx.xxx"
          action  = "Allow"
        }
      ]
    }
  }
}

错误信息 #

│ Error: Unsupported attribute
│
│   on ..\modules\event_hub_namespace\main.tf line 39, in resource "azurerm_eventhub_namespace" "namespace":
│   39:         for_each = each.value.network_rulesets.virtual_network_rule != {} && each.value.network_rulesets.virtual_network_rule != null ? [1] : []
│
│ This object does not have an attribute named "value".
╵
╷
│ Error: Unsupported attribute
│
│   on ..\modules\event_hub_namespace\main.tf line 39, in resource "azurerm_eventhub_namespace" "namespace":
│   39:         for_each = each.value.network_rulesets.virtual_network_rule != {} && each.value.network_rulesets.virtual_network_rule != null ? [1] : []
│
│ This object does not have an attribute named "value".
╵
╷
│ Error: Unsupported attribute
│
│   on ..\modules\event_hub_namespace\main.tf line 47, in resource "azurerm_eventhub_namespace" "namespace":
│   47:         for_each = each.value.network_rulesets.ip_rule != [] && each.value.network_rulesets.value.ip_rule != null ? [1] : []
│
│ This object does not have an attribute named "value".
╵
╷
│ Error: Unsupported attribute
│
│   on ..\modules\event_hub_namespace\main.tf line 47, in resource "azurerm_eventhub_namespace" "namespace":
│   47:         for_each = each.value.network_rulesets.ip_rule != [] && each.value.network_rulesets.value.ip_rule != null ? [1] : []
│
│ This object does not have an attribute named "value".

解决方案 #

错误根源在于dynamic块内部迭代器引用错误，以及数组遍历逻辑错误，修正后的network_rulesets块代码如下：

dynamic "network_rulesets" {
  for_each = var.settings.network_rulesets != null && length(keys(var.settings.network_rulesets)) > 0 ? [var.settings.network_rulesets] : []
  content {
    default_action                 = lookup(network_rulesets.value, "default_action", "Allow")
    trusted_service_access_enabled = lookup(network_rulesets.value, "trusted_service_access_enabled", true)

    dynamic "virtual_network_rule" {
      for_each = lookup(network_rulesets.value, "virtual_network_rule", [])
      content {
        subnet_id                                       = virtual_network_rule.value.subnet_id
        ignore_missing_virtual_network_service_endpoint = lookup(virtual_network_rule.value, "ignore_missing_virtual_network_service_endpoint", false)
      }
    }

    dynamic "ip_rule" {
      for_each = lookup(network_rulesets.value, "ip_rule", [])
      content {
        ip_mask = ip_rule.value.ip_mask
        action  = lookup(ip_rule.value, "action", "Allow")
      }
    }
  }
}

修正要点说明 #

1. 迭代器引用修正：内层dynamic块中，应使用外层dynamic的迭代器名称network_rulesets.value访问网络规则集对象，而非错误的each.value。
2. 数组遍历优化：virtual_network_rule和ip_rule是数组类型，直接用for_each遍历数组即可，无需判断后转为单元素数组，这样每个数组元素都会生成对应的规则块。
3. 空值安全处理：使用lookup函数替代直接属性访问，可在属性不存在时返回默认值，避免空值错误，比try或条件判断更简洁。
4. 外层for_each优化：将原[1]改为直接传入var.settings.network_rulesets的单元素数组，逻辑更清晰，便于后续维护。

内容的提问来源于stack exchange，提问作者NickP