Terraform部署Azure虚拟桌面主机池：仅创建主机池未生成VM求助

问题根源 #

你使用的vm_template字段并不是让Terraform自动创建会话主机虚拟机的参数，它仅用于为Azure门户提供预设的VM配置模板，方便后续在门户中手动部署会话主机。Terraform本身不会解析这个JSON内容来创建VM，因此只会生成主机池，不会创建对应的虚拟机。

正确实现步骤 #

要自动创建AVD会话主机并注册到主机池，需要单独定义虚拟机资源，并通过脚本或扩展完成主机池注册。以下是完整的实现方案：

1. 调整主机池资源（移除无效的vm_template）

保留主机池的核心配置，删除vm_template字段：

resource "azurerm_virtual_desktop_host_pool" "example" {
  location                  = var.rglocation
  resource_group_name       = var.rgname
  name                      = var.hostpoolname
  validate_environment      = false
  preferred_app_group_type  = "Desktop"
  type                      = "Pooled"
  load_balancer_type        = var.loadbalncealgorithm
  maximum_sessions_allowed  = var.sessionllimit
}

2. 创建会话主机虚拟机（加入Entra ID）

定义Windows虚拟机资源，配置Entra ID加入、AVD所需镜像和磁盘参数，同时通过远程执行脚本安装AVD代理并注册到主机池：

# 引用现有子网
data "azurerm_subnet" "privsub" {
  name                 = var.privsubname
  virtual_network_name = var.vnetname
  resource_group_name  = var.rgname
}

# 获取当前租户/订阅ID用于注册
data "azurerm_client_config" "current" {}

# 创建公网IP（用于远程执行注册脚本，可根据需求改为私有网络访问）
resource "azurerm_public_ip" "avd_pip" {
  count               = var.vmcount
  name                = "${var.vmNamePrefix}-pip-${count.index}"
  resource_group_name = var.rgname
  location            = var.rglocation
  allocation_method   = "Dynamic"
}

# 创建网络接口
resource "azurerm_network_interface" "avd_nic" {
  count               = var.vmcount
  name                = "${var.vmNamePrefix}-nic-${count.index}"
  resource_group_name = var.rgname
  location            = var.rglocation

  ip_configuration {
    name                          = "internal"
    subnet_id                     = data.azurerm_subnet.privsub.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.avd_pip[count.index].id
  }
}

# 创建AVD会话主机VM
resource "azurerm_windows_virtual_machine" "avd_session_host" {
  count                 = var.vmcount
  name                  = "${var.vmNamePrefix}-${count.index}"
  resource_group_name   = var.rgname
  location              = var.rglocation
  size                  = "Standard_B2s"
  admin_username        = var.localadminusername
  admin_password        = "PasswordForLocalAdmin"
  network_interface_ids = [azurerm_network_interface.avd_nic[count.index].id]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "StandardSSD_LRS"
    disk_size_gb         = 128
  }

  source_image_reference {
    publisher = "microsoftwindowsdesktop"
    offer     = "windows-10"
    sku       = "win10-21h2-avd-g2"
    version   = "latest"
  }

  # 启用TrustedLaunch安全类型
  security_type = "TrustedLaunch"

  # 配置系统分配身份用于Entra ID加入
  identity {
    type = "SystemAssigned"
  }

  # 远程执行脚本安装AVD代理并注册到主机池
  provisioner "remote-exec" {
    inline = [
      "Set-ExecutionPolicy Bypass -Scope Process -Force",
      "Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/Azure/RDS-Templates/master/AVD/wvd-agent-install.ps1'))",
      "& 'C:\\Program Files\\Microsoft RDInfra\\RDAgentBootLoader.exe' /register -tenantid ${data.azurerm_client_config.current.tenant_id} -hostpoolname ${azurerm_virtual_desktop_host_pool.example.name} -subscriptionid ${data.azurerm_client_config.current.subscription_id} -resourcegroup ${var.rgname} -verbose"
    ]

    connection {
      type     = "winrm"
      host     = azurerm_public_ip.avd_pip[count.index].ip_address
      user     = var.localadminusername
      password = "PasswordForLocalAdmin"
      https    = true
      insecure = true
    }
  }
}

3. 关键注意事项

• 确保VM所在网络能访问Azure服务（比如通过公网IP或私有端点），否则无法下载AVD代理和完成注册
• 用于注册的系统分配身份需要有Virtual Desktop Host Pool Contributor或类似权限，可通过azurerm_role_assignment资源配置
• 如果不需要公网IP，可改用私有网络内的WinRM访问，或者使用Azure自定义脚本扩展替代remote-exec

内容的提问来源于stack exchange，提问作者Roshan Thamalaka