Terraform部署Azure VNet时因Azure策略触发子网创建失败问题咨询

方案1：在子网资源内联指定NSG和路由表 #

Terraform的azurerm_subnet原生支持直接配置network_security_group_id和route_table_id参数，创建子网时会一次性完成关联操作，对应Azure API的原子请求，不会触发策略对“未关联NSG子网”的拒绝逻辑。

示例代码：

resource "azurerm_virtual_network" "example" {
  name                = "example-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_network_security_group" "example" {
  name                = "example-nsg"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_route_table" "example" {
  name                = "example-rt"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
}

resource "azurerm_subnet" "example" {
  name                 = "example-subnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.1.0/24"]
  # 直接在子网创建阶段关联NSG和路由表
  network_security_group_id = azurerm_network_security_group.example.id
  route_table_id            = azurerm_route_table.example.id
}

方案2：通过ARM模板嵌套实现原子操作 #

如果需要保留现有资源拆分的结构，可通过Terraform调用ARM模板（或Bicep编译后的ARM JSON）完成子网与NSG、路由表的关联，利用ARM的原子部署特性绕过Terraform分步执行的限制。

示例代码：

resource "azurerm_resource_group_template_deployment" "subnet_deployment" {
  name                = "subnet-atomic-deployment"
  resource_group_name = azurerm_resource_group.example.name
  template_content    = file("subnet-with-nsg.json") # 传入Bicep编译后的ARM JSON文件

  parameters = {
    vnetName             = azurerm_virtual_network.example.name
    subnetName           = "example-subnet"
    subnetPrefix         = "10.0.1.0/24"
    nsgId                = azurerm_network_security_group.example.id
    routeTableId         = azurerm_route_table.example.id
  }
}

方案3：临时策略豁免（谨慎使用） #

若上述方案无法落地，可通过Terraform创建临时策略豁免，允许本次部署创建未关联NSG的子网，待关联操作完成后自动过期失效。

示例代码：

# 创建临时策略豁免，仅针对当前子网部署
resource "azurerm_policy_exemption" "subnet_exemption" {
  name                = "subnet-nsg-temp-exemption"
  resource_group_name = azurerm_resource_group.example.name
  policy_assignment_id = "/subscriptions/<你的订阅ID>/providers/Microsoft.Authorization/policyAssignments/<策略分配ID>"
  exemption_category  = "Waiver"
  expires_on          = timeadd(timestamp(), "1h") # 1小时后自动过期，缩小安全风险范围
}

# 子网创建依赖豁免生效
resource "azurerm_subnet" "example" {
  name                 = "example-subnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.1.0/24"]

  depends_on = [azurerm_policy_exemption.subnet_exemption]
}

# 关联NSG和路由表
resource "azurerm_subnet_network_security_group_association" "example" {
  subnet_id                 = azurerm_subnet.example.id
  network_security_group_id = azurerm_network_security_group.example.id
}

resource "azurerm_subnet_route_table_association" "example" {
  subnet_id      = azurerm_subnet.example.id
  route_table_id = azurerm_route_table.example.id
}

注意：此方案需确保你拥有创建策略豁免的权限，且严格控制豁免的有效期和范围，避免过度放宽安全限制。

内容的提问来源于stack exchange，提问作者PLK