创建azurerm_windows_virtual_machine_scale_set时patchMode参数无效的无订阅级解决方案

问题场景 #

尝试通过Terraform创建azurerm_windows_virtual_machine_scale_set资源，原始代码如下：

resource "azurerm_windows_virtual_machine_scale_set" "vmss" {
  name                 = local.name
  resource_group_name  = local.resource_group_name
  location             = local.location
  sku                  = local.skutier
  instances            = 2
  admin_password       = P@$word12345
  admin_username       = admin123
  computer_name_prefix = "vm-"  

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = local.vmss_sku_name
    version   = "latest"
  }
  os_disk {
    storage_account_type = "Standard_LRS"
    caching              = "ReadWrite"
  }

  network_interface {
    name    = local.nic
    primary = true

    ip_configuration {
      name      = local.ipconfig
      primary   = true
      subnet_id = data.azurerm_subnet.subnet.id
    }
  }
}

执行terraform apply时触发如下错误：

╷
│ Error: creating Windows Virtual Machine Scale Set (Subscription: "XYZ"
│ Resource Group Name: "rg"
│ Virtual Machine Scale Set Name: "vmss"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: InvalidParameter: The property 'windowsConfiguration.patchSettings.patchMode' is not valid because the 'Microsoft.Compute/InGuestAutoPatchVmssUniformPreview' feature is not enabled for this subscription.
│
│   with azurerm_windows_virtual_machine_scale_set.vmss,
│   on virtualmachinescaleset.tf line 2, in resource "azurerm_windows_virtual_machine_scale_set" "vmss":
│    2: resource "azurerm_windows_virtual_machine_scale_set" "vmss":
│
╵

尝试添加upgrade_mode = "Manual"和enable_automatic_updates = false（或单独添加后者）后，错误依然存在。查看debug模式下生成的ARM JSON发现，upgradePolicy.mode仍为Automatic，enableAutomaticUpdates仍为true：

{
    "identity": {
        "type": "None",
        "userAssignedIdentities": null
    },
    "location": "westeurope",
    "properties": {
        "additionalCapabilities": {},
        "doNotRunExtensionsOnOverprovisionedVMs": false,
        "orchestrationMode": "Uniform",
        "overprovision": true,
        "scaleInPolicy": {
            "forceDeletion": false,
            "rules": [
                "Default"
            ]
        },
        "singlePlacementGroup": true,
        "upgradePolicy": {
            "mode": "Automatic"
        },
        "virtualMachineProfile": {
            "diagnosticsProfile": {
                "bootDiagnostics": {
                    "enabled": false,
                    "storageUri": ""
                }
            },
            "extensionProfile": {
                "extensionsTimeBudget": "PT1H30M"
            },
            "networkProfile": {
                "networkInterfaceConfigurations": [
                    {
                        "name": "vmss-nic",
                        "properties": {
                            "dnsSettings": {
                                "dnsServers": []
                            },
                            "enableAcceleratedNetworking": false,
                            "enableIPForwarding": false,
                            "ipConfigurations": [
                                {
                                    "name": "vmss-ipconfig",
                                    "properties": {
                                        "applicationGatewayBackendAddressPools": [],
                                        "applicationSecurityGroups": [],
                                        "loadBalancerBackendAddressPools": [],
                                        "loadBalancerInboundNatPools": [],
                                        "primary": true,
                                        "privateIPAddressVersion": "IPv4",
                                        "subnet": {
                                            "id": "/subscriptions/sybid/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/subnet"
                                        }
                                    }
                                }
                            ],
                            "primary": true
                        }
                    }
                ]
            },
            "osProfile": {
                "adminPassword": "Vmsspassword#3",
                "adminUsername": "vmssusername",
                "computerNamePrefix": "vm-",
                "secrets": [],
                "windowsConfiguration": {
                    "enableAutomaticUpdates": true,
                    "provisionVMAgent": true,
                    "winRM": {
                        "listeners": []
                    }
                }
            },
            "priority": "Regular",
            "storageProfile": {
                "dataDisks": [],
                "imageReference": {
                    "offer": "WindowsServer",
                    "publisher": "MicrosoftWindowsServer",
                    "sku": "2022-datacenter-azure-edition-core",
                    "version": "latest"
                },
                "osDisk": {
                    "caching": "ReadWrite",
                    "createOption": "FromImage",
                    "managedDisk": {
                        "storageAccountType": "Standard_LRS"
                    },
                    "osType": "Windows",
                    "writeAcceleratorEnabled": false
                }
            }
        }
    },
    "sku": {
        "capacity": 2,
        "name": "Standard_B4ms",
        "tier": "Standard"
    }
}       

解决方案 #

问题根源在于：Azure默认会为Windows VMSS启用需要订阅预览功能的自动补丁模式，而Terraform的顶层enable_automatic_updates配置可能未正确覆盖底层的patch_settings。需要显式配置windows_configuration块，指定补丁模式为手动，同时确保升级模式的配置生效。

修改后的Terraform代码如下：

resource "azurerm_windows_virtual_machine_scale_set" "vmss" {
  name                 = local.name
  resource_group_name  = local.resource_group_name
  location             = local.location
  sku                  = local.skutier
  instances            = 2
  admin_password       = P@$word12345
  admin_username       = admin123
  computer_name_prefix = "vm-"  
  upgrade_mode         = "Manual" # 显式指定升级模式

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = local.vmss_sku_name
    version   = "latest"
  }
  os_disk {
    storage_account_type = "Standard_LRS"
    caching              = "ReadWrite"
  }

  network_interface {
    name    = local.nic
    primary = true

    ip_configuration {
      name      = local.ipconfig
      primary   = true
      subnet_id = data.azurerm_subnet.subnet.id
    }
  }

  # 显式配置Windows系统设置，覆盖默认补丁模式
  windows_configuration {
    enable_automatic_updates = false
    patch_settings {
      patch_mode = "Manual" # 指定手动补丁模式，避免触发预览功能要求
    }
  }
}

说明 #

• 显式添加windows_configuration块并设置patch_settings.patch_mode = "Manual"，直接告诉Azure使用不需要预览功能的手动补丁模式，从根源避免错误。
• 同时指定upgrade_mode = "Manual"确保升级策略符合预期，避免Terraform默认的Automatic模式带来的冲突。

内容的提问来源于stack exchange，提问作者michasaucer