Azure Windows VM Terraform多CustomScriptExtension报错解决方案咨询

针对你遇到的Windows VM无法同时配置多个CustomScriptExtension、合并脚本又因Base64过大导致Terraform失败的问题，提供以下几种可行方案：

方案1：打包脚本至Blob存储，通过Extension拉取执行 #

将多个安装脚本打包成ZIP文件，托管在Azure存储账户的Blob中，让CustomScriptExtension下载并执行，彻底规避Base64内容限制：

1. 把三个安装脚本（如install_app1.ps1、install_app2.ps1、install_app3.ps1）和一个入口脚本entry.ps1打包为install_scripts.zip，入口脚本负责依次调用三个安装脚本：

   .\install_app1.ps1
   .\install_app2.ps1
   .\install_app3.ps1
   

2. 在Terraform中创建存储账户、Blob容器，并上传ZIP包：

   resource "azurerm_storage_account" "script_sa" {
     name                     = "scriptstoragexxx"
     resource_group_name      = azurerm_resource_group.rg.name
     location                 = azurerm_resource_group.rg.location
     account_tier             = "Standard"
     account_replication_type = "LRS"
   }
   
   resource "azurerm_storage_container" "script_container" {
     name                  = "scripts"
     storage_account_name  = azurerm_storage_account.script_sa.name
     container_access_type = "private"
   }
   
   resource "azurerm_storage_blob" "script_zip" {
     name                   = "install_scripts.zip"
     storage_account_name   = azurerm_storage_account.script_sa.name
     storage_container_name = azurerm_storage_container.script_container.name
     type                   = "Block"
     source                 = "./install_scripts.zip"
   }
   

3. 配置单个CustomScriptExtension拉取Blob中的ZIP并执行：

   resource "azurerm_custom_script_extension" "vm_install" {
     name                 = "MultiAppInstall"
     virtual_machine_id   = azurerm_windows_virtual_machine.vm.id
     publisher            = "Microsoft.Compute"
     type                 = "CustomScriptExtension"
     type_handler_version = "1.10"
   
     settings = jsonencode({
       "fileUris" = [azurerm_storage_blob.script_zip.url]
       "commandToExecute" = "powershell -ExecutionPolicy Unrestricted -File entry.ps1"
     })
   
     protected_settings = jsonencode({
       "storageAccountName" = azurerm_storage_account.script_sa.name
       "storageAccountKey"  = azurerm_storage_account.script_sa.primary_access_key
     })
   }
   

方案2：使用Azure DSC Extension替代CustomScriptExtension #

Azure DSC（Desired State Configuration）Extension支持编排多个配置步骤，适合复杂的软件安装场景：

1. 编写包含三个应用安装逻辑的DSC配置脚本（.ps1），编译为MOF文件；
2. 将MOF文件上传至存储Blob，通过Terraform配置azurerm_virtual_machine_extension调用DSC Extension执行配置：

   resource "azurerm_virtual_machine_extension" "dsc_install" {
     name                 = "DSCInstallApps"
     virtual_machine_id   = azurerm_windows_virtual_machine.vm.id
     publisher            = "Microsoft.Powershell"
     type                 = "DSC"
     type_handler_version = "2.77"
   
     settings = jsonencode({
       "ModulesUrl"          = azurerm_storage_blob.dsc_mof.url
       "ConfigurationFunction" = "InstallApps.ps1\\InstallAllApps"
       "Properties"          = {}
     })
   
     protected_settings = jsonencode({
       "storageAccountName" = azurerm_storage_account.script_sa.name
       "storageAccountKey"  = azurerm_storage_account.script_sa.primary_access_key
     })
   }
   

方案3：通过WinRM远程执行脚本（无Extension依赖） #

使用Terraform的null_resource配合local-exec，在VM创建完成后通过WinRM远程执行多个安装脚本，完全避开Extension的限制：

resource "null_resource" "remote_install" {
  depends_on = [azurerm_windows_virtual_machine.vm]

  provisioner "local-exec" {
    command = <<EOT
      $securePwd = ConvertTo-SecureString "${var.vm_admin_password}" -AsPlainText -Force
      $cred = New-Object System.Management.Automation.PSCredential("${var.vm_admin_username}", $securePwd)
      $sessionOpts = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
      $session = New-PSSession -ComputerName "${azurerm_public_ip.vm_ip.fqdn}" -Credential $cred -Port 5986 -UseSSL -SessionOption $sessionOpts
      
      # 远程执行三个安装脚本（可直接写逻辑或拉取外部脚本）
      Invoke-Command -Session $session -ScriptBlock {
        # 安装应用1逻辑
        Invoke-WebRequest -Uri "https://example.com/app1_installer.exe" -OutFile "app1.exe"
        Start-Process -FilePath ".\app1.exe" -ArgumentList "/silent" -Wait
        
        # 安装应用2逻辑
        Install-WindowsFeature -Name Web-Server
        
        # 安装应用3逻辑
        choco install app3 -y
      }
      
      Remove-PSSession $session
    EOT
    interpreter = ["powershell", "-Command"]
  }
}

注意：需确保VM的NSG开放5986端口（WinRM HTTPS），且VM已启用WinRM配置。

内容的提问来源于stack exchange，提问作者user2492572