使用azurerm_key_vault_key生成有效URL用于azurerm_disk_encryption_set报错

问题根源 #

Azure Disk Encryption Set（DES）要求引用带版本号的Key Vault密钥URL，而你当前使用的azurerm_key_vault_key.example.id是密钥的基础URL（格式为https://<vault>/keys/<name>），不包含版本号，导致格式校验失败。

解决方案步骤 #

1. 替换密钥URL为版本化ID #

修改Disk Encryption Set资源配置，将key_vault_key_id从azurerm_key_vault_key.example.id替换为azurerm_key_vault_key.example.versioned_id——这个属性会返回包含版本号的完整密钥URL（格式符合Azure要求：https://<vaultEndpoint>/keys/<keyName>/<keyVersion>）。

修改后的DES代码：

resource "azurerm_disk_encryption_set" "example" {
  name                = "des"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  key_vault_key_id    = azurerm_key_vault_key.example.versioned_id // 使用带版本的ID

  identity {
    type = "SystemAssigned"
  }
}

2. 配置Key Vault访问策略（必做） #

DES的系统身份需要具备Key Vault密钥的访问权限，否则后续加密磁盘时会失败。添加以下访问策略资源：

resource "azurerm_key_vault_access_policy" "des" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = azurerm_disk_encryption_set.example.identity[0].tenant_id
  object_id    = azurerm_disk_encryption_set.example.identity[0].principal_id

  key_permissions = [
    "Get",
    "WrapKey",
    "UnwrapKey",
  ]
}

3. 适配模块化结构 #

针对你的模块拆分，需要在模块间传递必要的属性：

• keyvault模块：输出密钥的versioned_id，并接收DES的身份信息配置访问策略
• disk_encryption_set模块：输出系统身份的principal_id和tenant_id，接收keyvault模块传递的versioned_id

keyvault模块示例

// 定义变量接收DES身份信息
variable "des_principal_id" {
  type        = string
  description = "Principal ID of Disk Encryption Set's system identity"
}

variable "des_tenant_id" {
  type        = string
  description = "Tenant ID of Disk Encryption Set's system identity"
}

// 密钥资源（保持原有配置）
resource "azurerm_key_vault_key" "example" {
  name         = "des-example-key"
  key_vault_id = azurerm_key_vault.example.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "sign",
    "unwrapKey",
    "verify",
    "wrapKey",
  ]
}

// DES访问策略
resource "azurerm_key_vault_access_policy" "des" {
  key_vault_id = azurerm_key_vault.example.id
  tenant_id    = var.des_tenant_id
  object_id    = var.des_principal_id

  key_permissions = [
    "Get",
    "WrapKey",
    "UnwrapKey",
  ]
}

// 输出版本化密钥ID
output "key_versioned_id" {
  type        = string
  value       = azurerm_key_vault_key.example.versioned_id
}

disk_encryption_set模块示例

// 定义变量接收版本化密钥ID
variable "key_vault_key_versioned_id" {
  type        = string
  description = "Versioned ID of Key Vault Key for Disk Encryption Set"
}

variable "resource_group_name" {
  type = string
}

variable "location" {
  type = string
}

// DES资源
resource "azurerm_disk_encryption_set" "example" {
  name                = "des"
  resource_group_name = var.resource_group_name
  location            = var.location
  key_vault_key_id    = var.key_vault_key_versioned_id

  identity {
    type = "SystemAssigned"
  }
}

// 输出身份信息给keyvault模块
output "identity_principal_id" {
  type = string
  value = azurerm_disk_encryption_set.example.identity[0].principal_id
}

output "identity_tenant_id" {
  type = string
  value = azurerm_disk_encryption_set.example.identity[0].tenant_id
}

根模块调用示例

module "disk_encryption_set" {
  source                      = "./modules/disk_encryption_set"
  resource_group_name         = module.resource_group.name
  location                    = module.resource_group.location
  key_vault_key_versioned_id  = module.keyvault.key_versioned_id
}

module "keyvault" {
  source              = "./modules/keyvault"
  resource_group_name = module.resource_group.name
  location            = module.resource_group.location
  des_principal_id    = module.disk_encryption_set.identity_principal_id
  des_tenant_id       = module.disk_encryption_set.identity_tenant_id
}

内容的提问来源于stack exchange，提问作者mysticBliss