如何修改Terraform代码创建Azure SQL V2连接并配置托管标识认证

要把现有V1 Azure SQL API连接改成V2版本并启用托管身份认证，需要对Terraform代码做以下关键调整：

核心修改项 #

• 升级资源API版本到V2对应版本
• 替换API引用为V2版SQL Server连接器
• 调整参数值明确指定托管身份认证类型
• 补充V2连接必需的配置属性

修改后的完整代码 #

# Create Azure API Connection SQL V2 Connection with Managed Identity Auth. Used by Logic-App to query Azure SQL databases.
resource "azapi_resource" "sql_conn_v2" {
  type      = "Microsoft.Web/connections@2018-07-01-preview"
  name      = local.sql_connection
  parent_id = data.azurerm_resource_group.solution_rg.id
  location  = var.location
  tags      = local.tags

  body = jsonencode({
    properties = {
      displayName = local.sql_connection
      statuses = [
        {
          status = "Connected"
        }
      ]
      parameterValues = {
        authenticationType = "ManagedIdentity"
        sqlServerEndpoint  = "<你的SQL服务器FQDN>" # 替换为实际地址，比如xxx.database.windows.net
        databaseName       = "<目标数据库名称>"        # 替换为要连接的数据库名
      }
      api = {
        name        = "sqlserver"
        displayName = "SQL Server"
        description = "Microsoft SQL Server is a relational database management system developed by Microsoft. Connect to SQL Server to manage data. You can perform various actions such as create, update, get, and delete on rows in a table."
        iconUri     = "https://connectoricons-prod.azureedge.net/releases/v1.0.1686/1.0.1686.3706/sql/icon.png"
        brandColor  = "#ba141a"
        id          = "/subscriptions/${data.azurerm_subscription.current.subscription_id}/providers/Microsoft.Web/locations/uksouth/managedApis/sqlserver"
        type        = "Microsoft.Web/locations/managedApis"
      }
      connectionRuntimeUrl = "https://europe-002.azure-apihub.net/apim/sqlserver" # 根据部署区域调整，示例为UK South对应地址
    }
  })
}

各修改说明 #

1. 资源API版本：V2连接需使用Microsoft.Web/connections@2018-07-01-preview，替代原V1的2016-06-01版本
2. API标识符：V2 SQL连接器的官方名称是sqlserver，而非V1的sql，因此API的name和id路径都要对应修改
3. 认证参数：在parameterValues中明确设置authenticationType = "ManagedIdentity"，同时必须指定SQL服务器地址和目标数据库名称
4. 连接运行时URL：V2连接需要指定connectionRuntimeUrl，该值随部署区域变化，可根据实际区域调整对应地址
5. 权限配置：需确保逻辑应用的托管身份（系统/用户分配）已被授予目标SQL数据库的访问权限（如db_datareader、db_datawriter角色）

内容的提问来源于stack exchange，提问作者Ian Carrick