如何通过Archetype覆盖Azure CAF企业级模块的logWorkspaceId

使用Terraform的Azure云采用框架（CAF）Enterprise Scale模块时，尝试覆盖logWorkspaceId默认值未生效。目标是为logWorkspaceId设置自定义值，已尝试针对es_root原型进行原型覆盖配置，但默认值仍未改变。

配置代码如下：

module "enterprise_scale" {
  source  = "Azure/caf-enterprise-scale/azurerm"
  version = "5.0.3" # change this to your desired version, 

  default_location = ""

  providers = {
    azurerm              = azurerm
    azurerm.connectivity = azurerm
    azurerm.management   = azurerm
  }

  root_parent_id = data.azurerm_client_config.core.tenant_id
  root_id        = var.root_id
  root_name      = var.root_name
  archetype_config_overrides = {
    root = {
      archetype_id = "es_root"
      parameters = {
        "Deploy-Resource-Diag" = {
         logAnalyticsWorkspaceId = data.azurerm_log_analytics_workspace.example.id
      }
    }
  }
} 

  deploy_core_landing_zones = false
  deploy_management_resources    = true
  subscription_id_management     = local.subscription_id_management
  configure_management_resources = local.configure_management_resources
  
 
}

1. 修复配置语法错误 #

你的配置存在语法闭合错误，导致Terraform无法正确解析原型覆盖规则。"Deploy-Resource-Diag"块缺少闭合}，同时archetype_config_overrides的闭合位置错误。修正后的完整配置如下：

module "enterprise_scale" {
  source  = "Azure/caf-enterprise-scale/azurerm"
  version = "5.0.3"

  default_location = ""

  providers = {
    azurerm              = azurerm
    azurerm.connectivity = azurerm
    azurerm.management   = azurerm
  }

  root_parent_id = data.azurerm_client_config.core.tenant_id
  root_id        = var.root_id
  root_name      = var.root_name

  archetype_config_overrides = {
    root = {
      archetype_id = "es_root"
      parameters = {
        "Deploy-Resource-Diag" = {
          logAnalyticsWorkspaceId = data.azurerm_log_analytics_workspace.example.id
        }
      }
    }
  }

  deploy_core_landing_zones = false
  deploy_management_resources    = true
  subscription_id_management     = local.subscription_id_management
  configure_management_resources = local.configure_management_resources
}

2. 验证工作区数据源有效性 #

确保data.azurerm_log_analytics_workspace.example配置正确，能正常读取到目标工作区的ID。可以通过执行terraform plan查看该数据源的输出值，确认其指向你期望的Log Analytics工作区。

3. 确认策略分配层级匹配 #

es_root原型对应根管理组层级的策略分配，如果你需要在子管理组或订阅层级覆盖该参数，需针对对应层级的原型单独配置。若目标是全局覆盖，修正语法后的root层级配置即可生效。

4. 强制刷新部署状态 #

修正配置后，执行以下命令刷新状态并重新部署：

terraform init -upgrade
terraform plan
terraform apply

内容的提问来源于stack exchange，提问作者jos ninja