Terraform环境下，能否用Azure AppConfiguration填充Container App密钥？

方案一：利用Azure Container Apps原生的App Configuration引用（推荐） #

Azure Container Apps支持直接在环境变量/密钥中引用App Configuration的配置项，包括那些指向Key Vault的引用项。这种方式不需要Terraform提前解析值，而是让Container App在运行时自动从App Configuration获取（并自动解析Key Vault引用），敏感值不会经过Terraform状态，更安全且适配多环境场景。

步骤1：配置托管身份及权限

首先为Container App创建用户托管身份，并赋予它访问App Configuration和Key Vault的权限：

# 创建用户托管身份
resource "azurerm_user_assigned_identity" "ca_identity" {
  name                = "ca-env-identity"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
}

# 赋予App Configuration数据读取权限
resource "azurerm_role_assignment" "app_config_reader" {
  scope                = azurerm_app_configuration.example.id
  role_definition_name = "App Configuration Data Reader"
  principal_id         = azurerm_user_assigned_identity.ca_identity.principal_id
}

# 赋予Key Vault密钥读取权限（如果存在Key Vault引用项）
resource "azurerm_role_assignment" "kv_secret_user" {
  scope                = azurerm_key_vault.example.id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = azurerm_user_assigned_identity.ca_identity.principal_id
}

步骤2：在Container App中配置引用

直接在Container App的密钥/环境变量中使用App Configuration的引用语法：

resource "azurerm_container_app" "example" {
  name                = "demo-container-app"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  environment_id      = azurerm_container_app_environment.example.id

  # 关联托管身份
  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.ca_identity.id]
  }

  # 引用App Configuration中的敏感项（存储为Container App密钥）
  secret {
    name  = "db_password"
    value = "@Microsoft.AppConfiguration(Endpoint=https://${azurerm_app_configuration.example.name}.azconfig.io;Key=db.password;Label=prod)"
  }

  template {
    container {
      name   = "demo-container"
      image  = "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
      # 环境变量引用密钥
      env {
        name  = "DB_PASSWORD"
        secret = "db_password"
      }
      # 直接引用App Configuration中的非敏感配置项
      env {
        name  = "APP_ENV"
        value = "@Microsoft.AppConfiguration(Endpoint=https://${azurerm_app_configuration.example.name}.azconfig.io;Key=app.env;Label=prod)"
      }
    }
  }
}

方案二：Terraform中解析App Configuration值（不推荐生产环境） #

如果必须在Terraform阶段获取实际值，可以通过external数据源调用Azure CLI读取App Configuration的真实值，但这种方式会将敏感值写入Terraform状态，存在安全风险。

# 获取App Configuration配置项（返回的是引用URL）
data "azurerm_app_configuration_key" "db_password" {
  name                  = "db.password"
  app_configuration_id  = azurerm_app_configuration.example.id
  label                 = "prod"
}

# 调用Azure CLI获取实际值
data "external" "resolve_secret" {
  program = [
    "az", "appconfig", "kv", "show",
    "--name", azurerm_app_configuration.example.name,
    "--key", data.azurerm_app_configuration_key.db_password.name,
    "--label", data.azurerm_app_configuration_key.db_password.label,
    "--value-only"
  ]
}

# 配置Container App密钥
resource "azurerm_container_app" "example" {
  # ...其他配置...
  secret {
    name  = "db_password"
    value = data.external.resolve_secret.result.value
  }
}

关键注意事项 #

• 确保App Configuration中的Key Vault引用项已正确配置，且Key Vault的访问策略允许托管身份读取密钥。
• 多环境场景下，可通过App Configuration的Label字段区分不同环境（如prod/staging），Terraform只需切换引用的标签即可。

内容的提问来源于stack exchange，提问作者Daniel Smith