如何在Terraform中获取azurerm_storage_account的endpoint_resource_id

在配置Azure存储账户的private_link_access规则时，当前代码硬编码了endpoint_resource_id为"/subscriptions/00000-00000-00000-00000/providers/Microsoft.Security/datascanners/storageDataScanner"，希望通过Terraform数据源或其他动态方式获取该ID，避免硬编码的维护风险。

用户提供的配置代码如下：

main.tf #

resource "azurerm_storage_account" "storageaccount" {
  name                              = var.azstorageaccount_name
  resource_group_name               = data.azurerm_resource_group.system_rg_name.name
  location                          = var.location
  account_tier                      = var.account_tier             # Premium, Standard
  account_replication_type          = var.account_replication_type # GRS
  account_kind                      = var.account_kind             # FileStorage
  access_tier                       = var.access_tier              # Hot, Cool
  large_file_share_enabled          = var.large_file_share_enabled
  is_hns_enabled                    = var.is_hns_enabled
  sftp_enabled                      = var.is_sftp_enabled
  public_network_access_enabled     = var.public_network_access_enabled

  blob_properties  {
    container_delete_retention_policy {
      days = var.container_delete_retention_policy
    }
    delete_retention_policy {
      days = var.delete_retention_policy
    }
  }
  
  network_rules {
    default_action             = var.network_rules_default_action
    ip_rules                   = toset("${var.network_rules_ip_rules}")
    private_link_access {
      endpoint_resource_id = "/subscriptions/00000-00000-00000-00000/providers/Microsoft.Security/datascanners/storageDataScanner"
    }
    # virtual_network_subnet_ids = [data.azurerm_subnet.network_subnet.id]
  }

  tags = {
    Environment = "${var.tag}"
  }
}

var.tf #

variable "azstorageaccount_name" {
  type    = string
  default = "teststroage001"
}

variable "large_file_share_enabled" {
  type    = string
  default = "false"
}

variable "account_tier" {
  type    = string
  default = "Standard"
}

variable "account_replication_type" {
  type    = string
  default = "LRS"
}

variable "account_kind" {
  type    = string
  default = "BlobStorage"
}

variable "access_tier" {
  type    = string
  default = "Cool"
}

variable "is_hns_enabled" {
  type    = string
  default = "false"
}

variable "is_sftp_enabled" {
  type    = string
  default = "false"
}

variable "public_network_access_enabled" {
  type    = string
  default = "true"
}

variable "container_delete_retention_policy" {
  type    = string
  default = "7"
}

variable "delete_retention_policy" {
  type    = string
  default = "7"
}

variable "network_rules_default_action" {
  type = string
  default = "Deny" # Allow
}

variable "network_rules_ip_rules" {
  type = list(string)
  default = [ " ]
}

variable "endpoint_resource_id" {
  type    = string
  default = ""
}

1. 使用通用资源数据源azurerm_resource动态查询 #

由于Azure Security的storageDataScanner没有专门的Terraform数据源，可以通过通用的azurerm_resource资源查询来获取其ID，避免硬编码。

添加以下数据源配置：

data "azurerm_resource" "security_datascanner" {
  name                = "storageDataScanner"
  resource_type       = "Microsoft.Security/datascanners"
  subscription_id     = "00000-00000-00000-00000" # 若资源在当前订阅下，可省略该字段
}

然后修改存储账户的private_link_access配置，引用数据源的ID：

private_link_access {
  endpoint_resource_id = data.azurerm_resource.security_datascanner.id
}

2. 若资源为当前配置内创建（非Azure内置） #

如果这个storageDataScanner是你通过Terraform自行创建的资源，直接引用该资源实例的id字段即可，示例：

private_link_access {
  endpoint_resource_id = azurerm_security_datascanner.your_scanner.id
}

（注：需根据实际使用的资源类型调整资源名称）

3. 修正变量配置的语法错误 #

你的var.tf中network_rules_ip_rules的默认值存在语法错误，需修正为：

variable "network_rules_ip_rules" {
  type    = list(string)
  default = []
}

内容的提问来源于stack exchange，提问作者gotothesky