如何使用Terraform为Azure API管理服务创建用户名密码身份

Azure API管理（APIM）的用户名密码身份（即内置本地账户）并不对应Terraform官方提供的azurerm_api_management_identity_provider_*系列资源，这类身份是直接通过APIM的用户实体进行管理的。以下是具体实现步骤：

1. 确认APIM实例启用本地身份验证 #

默认情况下APIM允许本地账户登录，若需显式确保该功能开启，可在azurerm_api_management资源配置中确认（通常无需额外修改，除非此前手动禁用过）。

2. 创建带密码的本地APIM用户 #

使用azurerm_api_management_user资源创建本地用户，并通过password字段设置登录密码。示例配置：

# 定义APIM实例
resource "azurerm_api_management" "demo" {
  name                = "demo-apim-service"
  location            = azurerm_resource_group.demo.location
  resource_group_name = azurerm_resource_group.demo.name
  publisher_name      = "Demo Org"
  publisher_email     = "admin@demo.org"
}

# 创建本地用户名密码账户
resource "azurerm_api_management_user" "local_user" {
  username           = "dev-user-001"
  api_management_name = azurerm_api_management.demo.name
  resource_group_name = azurerm_resource_group.demo.name
  email              = "dev-user-001@demo.org"
  first_name         = "Dev"
  last_name          = "User"
  password           = "P@ssw0rd_2024" # 生产环境请勿硬编码
}

3. 生产环境密码安全建议 #

硬编码密码存在安全风险，推荐使用以下两种方式保障密码安全：

方式1：自动生成密码 #

resource "random_password" "user_pwd" {
  length  = 18
  special = true
  override_special = "!@#$%^&*()"
}

resource "azurerm_api_management_user" "local_user" {
  # ...其他参数
  password = random_password.user_pwd.result
}

方式2：从Key Vault读取密码 #

data "azurerm_key_vault_secret" "user_pwd" {
  name         = "apim-local-user-password"
  key_vault_id = azurerm_key_vault.demo.id
}

resource "azurerm_api_management_user" "local_user" {
  # ...其他参数
  password = data.azurerm_key_vault_secret.user_pwd.value
}

4. 关联用户到API产品（可选） #

若需让该本地用户访问特定API产品，可通过azurerm_api_management_user_product资源建立关联：

resource "azurerm_api_management_product" "demo_product" {
  name                = "demo-api-product"
  api_management_name = azurerm_api_management.demo.name
  resource_group_name = azurerm_resource_group.demo.name
  display_name        = "Demo API Product"
  description         = "Access to demo APIs"
  subscription_required = true
}

resource "azurerm_api_management_user_product" "user_product_link" {
  user_id             = azurerm_api_management_user.local_user.id
  product_id          = azurerm_api_management_product.demo_product.id
  api_management_name = azurerm_api_management.demo.name
  resource_group_name = azurerm_resource_group.demo.name
}

内容的提问来源于stack exchange，提问作者needTobeanSRE