如何用Terraform在不使用azurerm_subscription模块的情况下更新Azure订阅标签

方法1：使用azurerm_subscription_tag专用资源 #

AzureRM Provider提供了独立的azurerm_subscription_tag资源，专门用于管理订阅标签，无需创建或跟踪订阅本身的生命周期，仅需传入目标订阅ID即可。

1. 在自定义模块./modules/subscription/中添加变量定义：

variable "subscription_id" {
  type        = string
  description = "目标订阅的ID"
}

variable "tags" {
  type        = map(string)
  description = "要应用到订阅的标签集合"
  default     = {}
}

2. 在模块内添加标签管理资源：

resource "azurerm_subscription_tag" "subscription_tags" {
  subscription_id = var.subscription_id
  tags            = var.tags

  # 可选配置：设为true会覆盖现有标签，false则合并新标签
  replace_existing = false
}

3. 根模板调用模块时传入参数：

module "subscription-project-pegasus" {
  source                     = "./modules/subscription/"

  subscription_id = "your-actual-subscription-id" # 替换为真实订阅ID
  subscription_access = [
    {
      aad_group = "all-employees-group"
      role      = "Reader"
    },
    {
      spn = "spn-pegasus"
      role = "Contributor"
    }
  ]

  ownership = {
    team = "Team Pegasus",
    pagerduty_id = "pegasus"
  }

  tags = {
    owner       = "pegasus"
    environment = "nonprod"
  }
}

方法2：通过null_resource调用Azure CLI #

若不想依赖AzureRM特定资源，可借助null_resource配合local-exec执行Azure CLI命令管理标签，灵活性更强。

在模块中添加以下资源（需提前在执行环境配置好Azure CLI权限）：

resource "null_resource" "set_subscription_tags" {
  triggers = {
    # 标签或订阅ID变化时自动重新执行
    subscription_id = var.subscription_id
    tags_hash       = sha1(jsonencode(var.tags))
  }

  provisioner "local-exec" {
    command = <<EOT
      az tag update --resource-id "/subscriptions/${var.subscription_id}" --operation Merge --tags ${join(" ", [for k, v in var.tags : "${k}=${v}"])}
    EOT
  }
}

模块变量定义和根模板调用方式与方法1一致。

方法3：使用Azure Policy强制订阅标签（合规场景） #

如果需要批量确保所有订阅符合标签规范，可创建Azure Policy定义，自动为订阅添加或修正标签：

1. 创建策略定义示例（强制添加owner和environment标签）：

{
  "properties": {
    "displayName": "强制订阅级标签",
    "policyType": "Custom",
    "mode": "All",
    "description": "确保订阅具备指定标签",
    "parameters": {
      "requiredTags": {
        "type": "Object",
        "metadata": {
          "description": "必须配置的标签键值对",
          "displayName": "必填标签"
        },
        "defaultValue": {
          "owner": "",
          "environment": ""
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions"
          },
          {
            "count": {
              "field": "[concat('tags[', keys(parameters('requiredTags')), ']')]"
            },
            "less": "[length(keys(parameters('requiredTags')))]"
          }
        ]
      },
      "then": {
        "effect": "modify",
        "details": {
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "operations": [
            {
              "operation": "addOrReplace",
              "field": "[concat('tags[', keys(parameters('requiredTags'))[0], ']')]",
              "value": "[parameters('requiredTags')[keys(parameters('requiredTags'))[0]]]"
            },
            {
              "operation": "addOrReplace",
              "field": "[concat('tags[', keys(parameters('requiredTags'))[1], ']')]",
              "value": "[parameters('requiredTags')[keys(parameters('requiredTags'))[1]]]"
            }
          ]
        }
      }
    }
  }
}

2. 将该策略分配到管理组或目标订阅层级，即可自动应用标签规则。

内容的提问来源于stack exchange，提问作者DivZ