Terraform创建Azure存储账户遇两类错误：dynamic块与network_rules超限

错误原因分析 #

1. dynamic "private_link_access"缩进错误：该块必须嵌套在network_rules内部，初始缩进位置不正确导致Terraform无法识别其合法位置。
2. 过多network_rules块：你用dynamic "network_rules"遍历var.network_rules，但var.network_rules是object类型而非列表，Terraform会遍历object的每个属性生成多个network_rules块，而Azure存储账户仅允许存在1个该块。

修正后的完整代码 #

main.tf

resource "azurerm_storage_account" "storageaccount" {
  name                     = var.azstorageaccount_name
  resource_group_name      = data.azurerm_resource_group.system_rg_name.name
  location                 = var.location
  account_tier             = var.account_tier
  account_replication_type = var.account_replication_type
  account_kind             = var.account_kind
  access_tier              = var.access_tier
  large_file_share_enabled = var.large_file_share_enabled
  is_hns_enabled           = var.is_hns_enabled
  sftp_enabled             = var.is_sftp_enabled
  public_network_access_enabled = var.public_network_access_enabled

  blob_properties {
    container_delete_retention_policy {
      days = var.container_delete_retention_policy
    }
    delete_retention_policy {
      days = var.delete_retention_policy
    }
  }

  # 直接定义单个network_rules块（Azure仅允许1个）
  network_rules {
    default_action             = "Deny"
    ip_rules                   = var.network_rules.ip_rules
    virtual_network_subnet_ids = var.network_rules.subnet_ids
    bypass                     = var.network_rules.bypass

    # 动态生成多个private_link_access条目（支持重复子块）
    dynamic "private_link_access" {
      for_each = var.private_link_access
      content {
        endpoint_resource_id = private_link_access.value.endpoint_resource_id
        endpoint_tenant_id   = private_link_access.value.endpoint_tenant_id
      }
    }
  }
}

var.tf（修正变量类型，符合Terraform最佳实践）

variable "location" {
  type    = string
  default = "Korea Central"
}

variable "system_rg" {
  description = "资源前缀"
  type        = string
  default     = "testrg"
}

variable "tag" {
  type    = string
  default = "prd"
}

variable "azstorageaccount_name" {
  type    = string
  default = "teststorage001"
}

# 布尔类型变量修正为bool，避免字符串转布尔的潜在问题
variable "large_file_share_enabled" {
  type    = bool
  default = false
}

variable "account_tier" {
  type    = string
  default = "Standard"
}

variable "account_replication_type" {
  type    = string
  default = "LRS"
}

variable "account_kind" {
  type    = string
  default = "StorageV2"
}

variable "access_tier" {
  type    = string
  default = "Hot"
}

variable "is_hns_enabled" {
  type    = bool
  default = false
}

variable "is_sftp_enabled" {
  type    = bool
  default = false
}

variable "public_network_access_enabled" {
  type    = bool
  default = true
}

# 天数变量修正为number类型
variable "container_delete_retention_policy" {
  type    = number
  default = 7
}

variable "delete_retention_policy" {
  type    = number
  default = 7
}

variable "network_rules" {
  type = object({
    ip_rules = list(string)
    subnet_ids = list(string)
    bypass = list(string)
  })
  default = {
    ip_rules = [ "xxx.xxx.xxx.xxx", "xxx.xxx.xxx.xxx" ]
    subnet_ids = [ "/subscriptions/000000-000000-00000/resourceGroups/...ids" ]
    bypass = [ "Logging", "Metrics" ]
  }
}

variable "private_link_access" {
  description = "允许访问的私有链接端点列表"
  type = list(object({
    endpoint_resource_id = string
    endpoint_tenant_id = optional(string, null)
  }))
  default = [ 
    { 
      endpoint_resource_id = "/subscriptions/0000-000000-000000-0000/providers/Microsoft.Security/datascanners/storageDataScanner"
      endpoint_tenant_id = null
    }
  ]
  nullable = false
}

核心修正点 #

• 移除dynamic "network_rules"，直接定义单个network_rules块，符合Azure资源限制。
• 将private_link_access动态块正确嵌套在network_rules内部，利用dynamic遍历列表生成多个私有链接端点配置。
• 修正布尔、数值类型变量的定义，避免类型不匹配的潜在问题，符合Terraform最佳实践。

内容的提问来源于stack exchange，提问作者gotothesky