如何用Terraform为azurerm_windows_function_app_slot创建密钥保管库访问策略？

我已成功创建azurerm_windows_function_app_slot资源，配置代码如下：

data "azurerm_windows_function_app" "reconciliationFunctionApp" {
  name                = "${local.funcprefix}-func"
  resource_group_name = data.azurerm_resource_group.lp.name
}
resource "azurerm_windows_function_app_slot" "reconciliationFuncSlot" {
  name               = local.slot
  function_app_id    = data.azurerm_windows_function_app.reconciliationFunctionApp.id
  storage_account_name = azurerm_storage_account.lpstorage.name

  site_config {}

  identity {
    type         = "SystemAssigned"
    identity_ids = []
  }
}

尝试直接引用该槽位资源创建azurerm_key_vault_access_policy时，出现错误：

error: Missing required argument object_id

参考方案尝试用data块引用槽位资源，配置如下：

data "azurerm_windows_function_app" "reconciliationFuncSlot" {
  name                = "${data.azurerm_windows_function_app.reconciliationFunctionApp.name}/slots/${azurerm_windows_function_app_slot.reconciliationFuncSlot.name}"
  resource_group_name = data.azurerm_resource_group.lp.name
  depends_on          = [azurerm_windows_function_app_slot.reconciliationFuncSlot]
}

resource "azurerm_key_vault_access_policy" "reconciliationFunc" {
   key_vault_id = azurerm_key_vault.lp.id
   tenant_id    = data.azurerm_client_config.current.tenant_id
   object_id    = data.azurerm_windows_function_app.reconciliationFuncSlot.identity[0].principal_id

   secret_permissions = [
     "Get",
     ...
   ]
}

但又出现错误：

Error: 'name' may only contain alphanumeric characters and dashes and up to 60 characters in length

可行解决方法 #

无需额外通过data块引用槽位资源，azurerm_windows_function_app_slot资源本身会直接输出系统分配标识的principal_id，直接引用该属性即可。

修正后的azurerm_key_vault_access_policy配置如下：

resource "azurerm_key_vault_access_policy" "reconciliationFunc" {
  key_vault_id = azurerm_key_vault.lp.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  # 直接从槽位资源的identity属性中获取principal_id
  object_id    = azurerm_windows_function_app_slot.reconciliationFuncSlot.identity[0].principal_id

  secret_permissions = [
    "Get",
    # 根据需求添加其他权限
  ]
}

错误原因说明 #

之前用data块引用时，错误地将主应用名/slots/槽位名作为azurerm_windows_function_app data源的name参数，但该data源仅接受独立函数应用的名称，不支持带/slots/的路径格式，因此触发了名称格式校验错误。而函数应用槽资源本身已暴露标识相关的输出属性，直接引用即可满足需求。

内容的提问来源于stack exchange，提问作者rjacobsen0