基于条件通过Terraform部署/销毁资源并保留关键资源的求助

核心问题 #

你的代码存在两个关键问题，导致无法实现“保留关键资源（Express Route）、销毁其他资源”的目标：

1. 关键资源的依赖引用错误：azurerm_express_route_circuit.expressr 未设置 count，但引用了带count的azurerm_resource_group.expressrg[count.index]——当var.delete_resources=true时，expressrg的count=0，此时count.index无意义，会直接报错。
2. 资源销毁逻辑冲突：虽然给express_route_circuit加了prevent_destroy=true，但它依赖的expressrg会被count=0触发销毁，Terraform会尝试先销毁依赖的资源，最终因prevent_destroy阻止而抛出错误，无法正常销毁其他资源。

修正方案 #

我们需要将**关键资源（Express Route及其所属资源组）**与普通资源的销毁逻辑分离，让关键资源不受var.delete_resources控制，仅用该变量管理普通资源的生命周期：

修正后的代码

variable "delete_non_critical_resources" {
  description = "设为true销毁普通资源，false保留所有资源"
  type        = bool
  default     = true
}

# 普通资源的count控制：true时销毁（count=0），false时保留（count=1）
locals {
  non_critical_count = var.delete_non_critical_resources ? 0 : 1
}

# --- 普通资源组及关联资源 ---
resource "azurerm_resource_group" "example-express-rg" {
  count    = local.non_critical_count
  name     = "example-vnet-rg"
  location = "West Europe"
}

resource "azurerm_virtual_network" "vnettest" {
  count               = local.non_critical_count
  name                = "example-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example-express-rg[count.index].location
  resource_group_name = azurerm_resource_group.example-express-rg[count.index].name
}

resource "azurerm_subnet" "gateway_subnet" {
  count               = local.non_critical_count
  name                = "GatewaySubnet"
  resource_group_name = azurerm_resource_group.example-express-rg[count.index].name
  virtual_network_name = azurerm_virtual_network.vnettest[count.index].name
  address_prefixes    = ["10.0.1.0/24"]
}

resource "azurerm_public_ip" "publicip" {
  count               = local.non_critical_count
  name                = "example-public-ip"
  location            = azurerm_resource_group.example-express-rg[count.index].location
  resource_group_name = azurerm_resource_group.example-express-rg[count.index].name
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_virtual_network_gateway" "example" {
  count               = local.non_critical_count
  name                = "testgw"
  location            = azurerm_resource_group.example-express-rg[count.index].location
  resource_group_name = azurerm_resource_group.example-express-rg[count.index].name
  type                = "ExpressRoute"
  vpn_type            = "PolicyBased"
  sku                 = "Standard"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.publicip[count.index].id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway_subnet[count.index].id
  }

  tags = {
    Purpose       = "CNetwork"
    ResorceOwner = "CTeam"
  }
}

# --- 关键资源：Express Route及其资源组，不受销毁变量控制 ---
resource "azurerm_resource_group" "expressrg" {
  # 移除count，始终保留该资源组
  name     = "exprtTest"
  location = "West Europe"

  lifecycle {
    prevent_destroy = true # 额外保护，防止误删
  }
}

resource "azurerm_express_route_circuit" "expressr" {
  name                  = "expressRoute1"
  resource_group_name   = azurerm_resource_group.expressrg.name # 直接引用资源，无需count.index
  location              = azurerm_resource_group.expressrg.location
  service_provider_name = "Equinix"
  peering_location      = "Singapore"
  bandwidth_in_mbps     = 1000

  sku {
    tier   = "Standard"
    family = "MeteredData"
  }

  tags = {
    Purpose       = "Core Infra Network"
    ResorceOwner = "Cloud Connectivity Team"
  }

  lifecycle {
    prevent_destroy = true
  }
}

逻辑说明 #

1. 变量更名：将delete_resources改为delete_non_critical_resources，明确其仅控制普通资源的销毁。
2. 关键资源独立：移除expressrg和express_route_circuit的count设置，确保它们始终存在；同时给expressrg也加上prevent_destroy，双重保护关键资源的资源组。
3. 修正引用方式：关键资源不再使用count.index引用依赖，直接通过资源名称访问属性，避免count导致的索引错误。
4. 正常销毁流程：当delete_non_critical_resources=true时，普通资源的count=0，Terraform会销毁这些资源；关键资源因无count控制且有prevent_destroy保护，会被保留。

内容的提问来源于stack exchange，提问作者Deepika