如何用Terraform高效创建多类型Azure资源的专用端点及DNS记录？

核心思路是利用Terraform的for_each迭代器配合本地值映射，将重复的资源定义抽象为一套模板，根据用户选择的资源类型自动生成对应实例，彻底避免代码冗余。

步骤1：定义模块输入变量 #

首先在模块中声明用户可配置的输入变量，指定需要创建的资源类型集合：

variable "selected_resource_types" {
  type        = set(string)
  description = "Azure存储资源类型集合，可选值：file、blob、queue、table"
  validation {
    condition     = alltrue([for type in var.selected_resource_types : contains(["file", "blob", "queue", "table"], type)])
    error_message = "仅支持file、blob、queue、table四种资源类型。"
  }
}

variable "storage_account_id" {
  type        = string
  description = "目标Azure存储账户的资源ID"
}

variable "virtual_network_subnet_id" {
  type        = string
  description = "用于部署私有端点的子网ID"
}

variable "private_dns_zone_resource_group_name" {
  type        = string
  description = "私有DNS区域所在的资源组名称"
}

步骤2：建立资源类型参数映射 #

通过本地值统一管理不同资源类型对应的subresource名称和私有DNS区域名称，后续资源定义直接引用该映射：

locals {
  resource_type_configs = {
    file = {
      subresource_name      = "file"
      private_dns_zone_name = "privatelink.file.core.windows.net"
    }
    blob = {
      subresource_name      = "blob"
      private_dns_zone_name = "privatelink.blob.core.windows.net"
    }
    queue = {
      subresource_name      = "queue"
      private_dns_zone_name = "privatelink.queue.core.windows.net"
    }
    table = {
      subresource_name      = "table"
      private_dns_zone_name = "privatelink.table.core.windows.net"
    }
  }

  # 过滤出用户选中的资源类型对应的配置
  selected_configs = {
    for type in var.selected_resource_types : type => local.resource_type_configs[type]
  }
}

步骤3：批量创建资源 #

基于local.selected_configs，用for_each一次性生成所有选中资源对应的私有端点、DNS区域数据源和A记录：

3.1 私有端点资源 #

resource "azurerm_private_endpoint" "storage" {
  for_each             = local.selected_configs
  name                 = "pe-storage-${each.key}"
  location             = split("/", var.storage_account_id)[4]
  resource_group_name  = split("/", var.storage_account_id)[4]
  subnet_id            = var.virtual_network_subnet_id

  private_service_connection {
    name                           = "psc-storage-${each.key}"
    private_connection_resource_id = var.storage_account_id
    subresource_names              = [each.value.subresource_name]
    is_manual_connection           = false
  }
}

3.2 私有DNS区域数据源 #

data "azurerm_private_dns_zone" "storage" {
  for_each            = local.selected_configs
  name                = each.value.private_dns_zone_name
  resource_group_name = var.private_dns_zone_resource_group_name
}

3.3 私有DNS A记录 #

resource "azurerm_private_dns_a_record" "storage" {
  for_each                = local.selected_configs
  name                     = split(".", data.azurerm_private_dns_zone.storage[each.key].name)[0]
  zone_name                = data.azurerm_private_dns_zone.storage[each.key].name
  resource_group_name      = var.private_dns_zone_resource_group_name
  ttl                      = 300
  records                  = [azurerm_private_endpoint.storage[each.key].private_service_connection[0].private_ip_address]

  depends_on = [azurerm_private_endpoint.storage]
}

方案优势 #

• 无冗余代码：仅需维护一套资源模板，新增资源类型只需在local.resource_type_configs中添加对应条目
• 灵活可控：用户通过selected_resource_types参数自由选择需要创建的资源类型，支持单类型或多类型组合
• 自动关联依赖：通过for_each和隐式依赖确保资源创建顺序正确

内容的提问来源于stack exchange，提问作者anotheropsguy