使用Terraform创建Azure Private Endpoint遇400错误：订阅未注册特性

用Terraform创建Azure私有端点时收到400（Bad Request）错误，错误提示：

SubscriptionNotRegisteredForFeature，订阅未注册执行请求操作所需的Microsoft.Network/AllowPrivateEndpoints特性。

同一订阅中已存在Private Endpoint资源，但查询该特性状态显示为Pending。相关代码及查询结果如下：

main.tf #

locals {
  team_name  = "devops"
  stack_name = "devops"

  location_abbreviations = { # map of location abbreviations according to naming conventions
    "southafricanorth" = "san"
    "westeurope"       = "euw"

  }
  resource_group_name = "${local.location_abbreviations[var.location]}-${var.environment}-${local.team_name}-rg-001"


  tags = { # list of tags
    env        = var.environment
    managed_by = "terraform"
    team       = local.team_name
  }
}


data "azurerm_client_config" "current" {}

data "terraform_remote_state" "platform" {
  backend = "azurerm"

  config = {
    subscription_id      = "********"
    resource_group_name  = "******"
    storage_account_name = "******"
    container_name       = "platform"
    key                  = "${var.environment}.tfstate"
  }
}


module "azurerm_resource_group" {
  source                  = "../../factory/resource-group"
  resource_group_name     = local.resource_group_name
  resource_group_location = var.location

}

module "azurerm_application_insights" {

  source                       = "../../factory/application-insights"
  app_insights_name            = "${local.location_abbreviations[var.location]}-${var.environment}-${local.team_name}-ai-001"
  location                     = var.location
  resource_group_name          = local.resource_group_name
  application_type             = "web"
  log_analytics_workspace_name = "${local.location_abbreviations[var.location]}-${var.environment}-${local.team_name}-logwkspace-001"
  tags                         = local.tags
  # Disable IP masking (captures the actual client IP address)
  disable_ip_masking = true
}

module "azurerm_private_endpoint" {
  source                                                    = "../../factory/private-endpoint"
  name                                                      = "${local.location_abbreviations[var.location]}-${var.environment}-lulapay-appInsight-endpoint-001"
  location                                                  = var.location
  resource_group_name                                       = local.resource_group_name
  subnet_id                                                 = data.terraform_remote_state.platform.outputs.private_endpoints_subnet_id
  private_service_connection_name                           = "app-insights-privatelink-dns-zones"
  private_service_connection_is_manual_connection           = false
  private_service_connection_private_connection_resource_id = module.azurerm_application_insights.id
  tags                                                      = local.tags
  private_dns_zone_group_name                               = "application-insights-private-dns-zones"
  private_dns_zone_group_name_private_dns_zone_ids          = [data.terraform_remote_state.platform.outputs.app_insights_privatelink_dns_zone_id]


}

# DNS A Record for Application Insights
resource "azurerm_private_dns_a_record" "example" {
  name                = "lulapay-app-insight-privatelink"
  zone_name           = split("/", trim(data.terraform_remote_state.platform.outputs.app_insights_privatelink_dns_zone_id, "/"))[7]
  resource_group_name = local.resource_group_name
  records             = [module.azurerm_private_endpoint.private_ip]
  ttl                 = 10
}

私有端点模块代码 #

resource "azurerm_private_endpoint" "main" {


  # define endpoint name based on app service name
  name                = var.name
  resource_group_name = var.resource_group_name
  location            = var.location
  subnet_id           = var.subnet_id
  tags                = var.tags
   
   private_dns_zone_group {
    name = var.private_dns_zone_group_name
    private_dns_zone_ids = var.private_dns_zone_group_name_private_dns_zone_ids
  }
  private_service_connection {
    name                           = var.private_service_connection_name
    private_connection_resource_id = var.private_service_connection_private_connection_resource_id
    is_manual_connection           = var.private_service_connection_is_manual_connection
    

  }
}

Azure CLI查询结果 #

$ az feature show --namespace Microsoft.Network --name AllowPrivateEndpoints
{
  "id": "/subscriptions/*********/providers/Microsoft.Features/providers/Microsoft.Network/features/AllowPrivateEndpoints",
  "name": "Microsoft.Network/AllowPrivateEndpoints",
  "properties": {
    "state": "Pending"
  },
  "type": "Microsoft.Features/providers/features"
}

内容的提问来源于stack exchange，提问作者Nicholas Namacha