使用Terraform导入Azure应用网关时规则变更问题求助

问题背景 #

使用Terraform导入已部署的Azure应用网关，通过动态块和模块实现多环境适配，tfvars已配置所有网关参数，但导入后Terraform计划显示需修改规则名称、调整规则顺序或替换规则值。相关代码如下：

现有rewrite_rule_set动态块 #

dynamic "rewrite_rule_set" {
  for_each = var.rewrite_rule_sets
  content {
    name = rewrite_rule_set.value["name"]
    dynamic "rewrite_rule" {
      for_each = rewrite_rule_set.value["rewrite_rule"]
      content {
        name          = rewrite_rule.value["name"]
        rule_sequence = rewrite_rule.value["rule_sequence"]
        dynamic "condition" {
          for_each = rewrite_rule.value["condition"]
          content {
            variable    = condition.value["variable"]
            pattern     = condition.value["pattern"]
            ignore_case = condition.value["ignore_case"]
            negate      = condition.value["negate"]
          }
        }
        # 省略其他配置块（request_header等）
      }
    }
  }
}

现有变量定义 #

variable "rewrite_rule_sets" {
  type = map(object({
    name = string
    rewrite_rule = optional(map(object({
      name          = string
      rule_sequence = string
      condition = optional(map(object({
        variable    = string
        pattern     = string
        ignore_case = optional(bool)
        negate      = optional(bool)
      })))
      request_header_configuration = optional(map(object({
        header_name  = string
        header_value = string
      })))
      response_header_configuration = optional(map(object({
        header_name  = string
        header_value = string
      })))
      url = optional(map(object({
        path         = optional(string)
        query_string = optional(string)
        components   = optional(string)
        reroute      = optional(bool)
      })))
    })))
  }))
}

核心解决步骤 #

1. 修正规则顺序问题：将map类型改为list类型 #

Azure应用网关的重写规则顺序由rule_sequence决定，但Terraform中map是无序结构，动态块遍历map时会按键名排序，导致生成的规则顺序与实际部署的网关不一致，触发计划中的顺序调整。

调整方案：把变量中rewrite_rule和condition的map类型改为list，确保Terraform按配置的顺序生成规则：

variable "rewrite_rule_sets" {
  type = map(object({
    name = string
    rewrite_rule = optional(list(object({
      name          = string
      rule_sequence = number # 同步修正类型为数字
      condition = optional(list(object({
        variable    = string
        pattern     = string
        ignore_case = optional(bool, true) # 添加默认值匹配Azure默认行为
        negate      = optional(bool, false)
      })))
      request_header_configuration = optional(list(object({
        header_name  = string
        header_value = string
      })))
      response_header_configuration = optional(list(object({
        header_name  = string
        header_value = string
      })))
      url = optional(object({ # url本身是单个对象，无需list
        path         = optional(string)
        query_string = optional(string)
        components   = optional(string)
        reroute      = optional(bool)
      })))
    })))
  }))
}

2. 修正动态块的遍历逻辑 #

对应变量类型调整，修改动态块的for_each为遍历list：

dynamic "rewrite_rule_set" {
  for_each = var.rewrite_rule_sets
  content {
    name = rewrite_rule_set.value.name
    dynamic "rewrite_rule" {
      for_each = rewrite_rule_set.value.rewrite_rule
      content {
        name          = rewrite_rule.value.name
        rule_sequence = rewrite_rule.value.rule_sequence
        dynamic "condition" {
          for_each = rewrite_rule.value.condition
          content {
            variable    = condition.value.variable
            pattern     = condition.value.pattern
            ignore_case = lookup(condition.value, "ignore_case", true) # 兜底默认值
            negate      = lookup(condition.value, "negate", false)
          }
        }
        # 处理request_header_configuration动态块示例
        dynamic "request_header_configuration" {
          for_each = rewrite_rule.value.request_header_configuration
          content {
            dynamic "header" {
              for_each = [request_header_configuration.value]
              content {
                header_name  = header.value.header_name
                header_value = header.value.header_value
              }
            }
          }
        }
        # 同理处理response_header_configuration和url块
      }
    }
  }
}

3. 同步类型与默认值 #

• rule_sequence：Azure实际存储为数字类型，原变量定义为string会导致类型不匹配，需改为number。
• 可选参数默认值：Azure对ignore_case默认值为true，negate默认值为false，变量中需显式设置默认值，避免Terraform因未配置参数而与实际资源产生差异。

4. 对比状态与配置 #

导入后执行terraform show，查看状态中应用网关的rewrite_rule_set结构，与本地配置逐一比对：

• 检查规则名称是否完全一致（注意大小写、特殊字符）
• 核对rule_sequence的数值是否与Azure实际一致
• 确认所有可选参数（如ignore_case）的取值与状态匹配

内容的提问来源于stack exchange，提问作者joharger