如何通过Terraform将WAR包部署至Azure App Service（无需Azure CLI）

以下提供两种符合需求的部署方案，均无需依赖Azure CLI，直接通过Terraform原生资源实现：

方案一：从本地（Azure Shell存储）直接部署 #

适用于sample.war存放在Azure Shell本地存储的场景，直接通过Terraform将文件推送到App Service：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# 定义资源组
resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "East US"
}

# 定义App Service计划
resource "azurerm_app_service_plan" "example" {
  name                = "example-appserviceplan"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  sku_name            = "B1"
}

# 定义App Service（适配Java War包环境）
resource "azurerm_app_service" "example" {
  name                = "example-appservice"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    java_version          = "11"
    java_container        = "TOMCAT"
    java_container_version = "9.0"
  }

  # 直接部署本地的sample.war文件
  zip_deployment {
    local_path = "./sample.war" # 根据Azure Shell中文件实际路径调整
  }
}

说明 #

• zip_deployment是Terraform azurerm provider原生支持的部署方式，无需调用Azure CLI
• 确保Azure Shell当前工作目录下存在sample.war，或修改local_path为文件绝对路径
• 可根据实际需求调整site_config中的Java版本、容器类型和版本

方案二：从Azure存储Blob部署 #

适用于先将War包上传到Azure存储Blob，再从Blob部署到App Service的场景：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# 资源组
resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "East US"
}

# 存储账户（名称需全局唯一）
resource "azurerm_storage_account" "example" {
  name                     = "examplestorageacc"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

# 私有存储容器
resource "azurerm_storage_container" "example" {
  name                  = "war-packages"
  storage_account_name  = azurerm_storage_account.example.name
  container_access_type = "private"
}

# 上传sample.war到Blob
resource "azurerm_storage_blob" "example_war" {
  name                   = "sample.war"
  storage_account_name   = azurerm_storage_account.example.name
  storage_container_name = azurerm_storage_container.example.name
  type                   = "Block"
  source                 = "./sample.war" # Azure Shell中文件路径
}

# 生成Blob的临时SAS访问URL
data "azurerm_storage_account_sas" "example" {
  connection_string = azurerm_storage_account.example.primary_connection_string
  https_only        = true
  resource_types {
    service   = false
    container = false
    object    = true
  }
  services {
    blob  = true
    queue = false
    table = false
    file  = false
  }
  start  = timeadd(timestamp(), "-1h")
  expiry = timeadd(timestamp(), "1h")
  permissions {
    read   = true
    add    = false
    create = false
    write  = false
    delete = false
    list   = false
  }
}

# App Service计划
resource "azurerm_app_service_plan" "example" {
  name                = "example-appserviceplan"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  sku_name            = "B1"
}

# App Service（从Blob部署War包）
resource "azurerm_app_service" "example" {
  name                = "example-appservice"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  app_service_plan_id = azurerm_app_service_plan.example.id

  site_config {
    java_version          = "11"
    java_container        = "TOMCAT"
    java_container_version = "9.0"
  }

  # 通过Blob的SAS URL完成部署
  zip_deployment {
    source_url = "${azurerm_storage_blob.example_war.url}${data.azurerm_storage_account_sas.example.sas}"
  }
}

说明 #

• 先将sample.war上传到私有存储容器，通过SAS URL授予App Service临时读取权限
• 可根据需求调整SAS URL的有效期（start和expiry参数）
• 全程无需调用Azure CLI，所有操作通过Terraform资源完成

关于之前local-exec调用Azure CLI的问题（可选参考） #

如果一定要使用local-exec，确保命令参数格式正确，示例如下：

resource "null_resource" "deploy_war" {
  depends_on = [azurerm_app_service.example]

  provisioner "local-exec" {
    command = "az webapp deploy --resource-group ${azurerm_resource_group.example.name} --name ${azurerm_app_service.example.name} --src-path ./sample.war --type war"
  }
}

• 无需添加--ids，直接通过资源组和App Service名称定位即可
• 需确保Azure Shell已完成az login且账号有对应资源操作权限

内容的提问来源于stack exchange，提问作者Lekha