使用Terraform集成Microsoft Defender for Cloud与逻辑应用时，connectionReferences块缺失导致工作流设计器异常的问题求助

各位好，

我正在尝试通过Terraform实现Microsoft Defender for Cloud和逻辑应用的集成，目标是让逻辑应用把Defender的告警推送到指定URL。手动配置这个流程完全没问题，但用基础设施即代码的方式实现时碰到了麻烦。

以下是我当前的Terraform配置代码：

resource "azurerm_logic_app_workflow" "logic-app" {
  location            = var.location
  name                = "logic-app-from-tf"
  resource_group_name = var.rg_name
}

resource "azurerm_logic_app_action_http" "action" {
  logic_app_id = azurerm_logic_app_workflow.logic-app.id
  method       = "POST"
  name         = "alert-action"
  uri          = "<URL>"
}

resource "azurerm_logic_app_trigger_custom" "trigger" {
  logic_app_id = azurerm_logic_app_workflow.logic-app.id
  name         = "When_an_Microsoft_Defender_for_Cloud_Alert_is_created_or_triggered"
  body         = jsonencode(
    {
      "type": "ApiConnectionWebhook",
      "inputs": {
        "host": {
          "connection": {
            "referenceName": "ascalert"
          }
        },
        "body": {
          "callback_url": "@{listCallbackUrl()}"
        },
        "path": "/Microsoft.Security/Alert/subscribe"
      }
    }
  )
}

resource "azurerm_security_center_automation" "workflow-automation" {
  name                = "workflow-from-tf"
  location            = var.location
  resource_group_name = var.rg_name

  action {
    trigger_url = "<URL>"
    resource_id = azurerm_logic_app_workflow.logic-app.id
    type        = "logicapp"
  }

  source {
    event_source = "Alerts"
    rule_set {
      rule {
        # 这里也有问题，暂时不知道原因...
        property_path  = "properties.metadata.severity"
        operator       = "Equals"
        expected_value = "High"
        property_type  = "String"
      }
    }
  }

  scopes = ["/subscriptions/${var.subscription_id}"]
}

这段代码成功创建了逻辑应用，也在Defender里创建了工作流自动化，但逻辑应用的设计器无法正常加载工作流。

我对比了手动配置生成的工作流代码和Terraform生成的代码，发现关键差异：

手动生成的完整工作流结构里有connectionReferences块，但Terraform生成的代码里这个块是空的：

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "actions": {
      "alert-action": {
        "type": "Http",
        "inputs": {
          "uri": "<url>",
          "method": "POST",
          "headers": {},
          "queries": {}
        },
        "runAfter": {}
      }
    },
    "contentVersion": "1.0.0.0",
    "outputs": {},
    "triggers": {
      "When_a_Microsoft_Defender_for_Cloud_alert_is_created_or_triggered": {
        "type": "ApiConnectionWebhook",
        "inputs": {
          "host": {
            "connection": {
              "referenceName": "ascalert"
            }
          },
          "body": {
            "callback_url": "@{listCallbackUrl()}"
          },
          "path": "/Microsoft.Security/Alert/subscribe"
        }
      }
    }
  },
  # Terraform生成的代码里这个块是空的
  "connectionReferences": {
    "ascalert": {
      "api": {
        "id": "/subscriptions/<sub_id>/providers/Microsoft.Web/locations/centralus/managedApis/ascalert"
      },
      "connection": {
        "id": "/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/Microsoft.Web/connections/ascalert"
      },
      "connectionName": "ascalert"
    }
  },
  "parameters": {}
}

我尝试添加了azurerm_api_connection资源，但这个块依然是空的，没有任何变化：

resource "azurerm_api_connection" "connection" {
  managed_api_id      = "/subscriptions/<sub_id>/providers/Microsoft.Web/locations/centralus/managedApis/ascalert"
  name                = "ascalert"
  resource_group_name = var.rg_name
}

想请教各位，我哪里操作错了？应该用什么Terraform资源来正确生成这个connectionReferences块？

我当前使用的版本：

• Terraform: 1.2.4
• AzureRM Provider: 3.29.0

备注：内容来源于stack exchange，提问作者Sunflame