Terraform实现：创建App Insights时从Key Vault配置APIM Logger命名值

完整配置示例 #

# 配置Azure Provider
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# 引用已存在的Key Vault
data "azurerm_key_vault" "existing" {
  name                = "your-existing-keyvault-name"
  resource_group_name = "your-keyvault-rg-name"
}

# 引用已存在的APIM实例
data "azurerm_api_management" "existing" {
  name                = "your-existing-apim-name"
  resource_group_name = "your-apim-rg-name"
}

# 创建Application Insights
resource "azurerm_application_insights" "example" {
  name                = "example-appinsights"
  location            = data.azurerm_api_management.existing.location
  resource_group_name = "your-appinsights-rg-name"
  application_type    = "web"
}

# 将App Insights的Instrumentation Key存入现有Key Vault
resource "azurerm_key_vault_secret" "appinsights_instrumentation_key" {
  name         = "appinsights-instrumentation-key"
  value        = azurerm_application_insights.example.instrumentation_key
  key_vault_id = data.azurerm_key_vault.existing.id

  # 确保App Insights创建完成后再写入密钥
  depends_on = [azurerm_application_insights.example]
}

# 为APIM实例配置访问Key Vault的权限（如果APIM还没有相关权限）
resource "azurerm_key_vault_access_policy" "apim" {
  key_vault_id = data.azurerm_key_vault.existing.id
  tenant_id    = data.azurerm_api_management.existing.tenant_id

  object_id = data.azurerm_api_management.existing.identity[0].principal_id

  secret_permissions = [
    "Get",
  ]
}

# 创建APIM命名值，引用Key Vault中的Instrumentation Key
resource "azurerm_api_management_named_value" "appinsights_key" {
  name                = "AppInsightsInstrumentationKey"
  api_management_name = data.azurerm_api_management.existing.name
  resource_group_name = data.azurerm_api_management.existing.resource_group_name
  value               = "@Microsoft.KeyVault(SecretUri=${azurerm_key_vault_secret.appinsights_instrumentation_key.id})"
  secret              = true # 标记为敏感信息，不在APIM门户明文显示

  depends_on = [azurerm_key_vault_secret.appinsights_instrumentation_key, azurerm_key_vault_access_policy.apim]
}

# 创建APIM Logger，使用上面的命名值
resource "azurerm_api_management_logger" "appinsights" {
  name                = "example-appinsights-logger"
  api_management_name = data.azurerm_api_management.existing.name
  resource_group_name = data.azurerm_api_management.existing.resource_group_name

  application_insights {
    instrumentation_key = azurerm_api_management_named_value.appinsights_key.value
  }

  depends_on = [azurerm_api_management_named_value.appinsights_key]
}

关键要点说明 #

• 依赖顺序控制：通过depends_on确保资源创建顺序：App Insights → Key Vault秘密 → APIM访问策略 → APIM命名值 → APIM Logger，避免因资源未就绪导致的错误。
• 权限配置：azurerm_key_vault_access_policy资源为APIM的系统身份授予Key Vault的Get秘密权限，确保APIM可以读取存储的Instrumentation Key。如果你的APIM已经配置过对应的Key Vault权限，可以删除这部分代码。
• 敏感信息处理：APIM命名值设置secret = true，防止密钥在APIM门户中明文展示，符合安全最佳实践。
• 无手动操作：整个流程完全由Terraform自动化完成，App Insights创建后自动将密钥存入Key Vault，无需事后手动添加。

内容的提问来源于stack exchange，提问作者Vowneee