通过PowerShell批量导入AzureAD组到Terraform失败，单条导入正常

问题背景 #

我正尝试创建tfstate.tf文件管理Azure门户中的用户和组，现有import_groups.csv文件内容如下：

"ObjectId","GroupsName"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[\`\"adm-xxx01\`\"]"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[\`\"exp-xxx01\`\"]"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[\`\"cod-xxx01\`\"]"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[\`\"tec-xxx01\`\"]"

其中adm-xxx01这类是字符串类型的资源名称，而非索引值。

批量执行命令及报错 #

我用以下PowerShell命令批量导入组到tfstate：

Import-Csv .\import_groups.csv | ForEach-Object {
    terraform import -var-file="./variables/variables.tfvars" azuread_group.$($_.GroupsName) $($_.ObjectId)
}

执行后每个组都报错：

│ Error: Invalid character
│ 
│   on <import-address> line 1:
│    1: azuread_group.aad_groups_services[\`adm-xxx01\`]
│ 
│ This character is not used within the language.

单条命令执行正常 #

但直接执行单条导入命令时一切正常：

terraform import -var-file="./variables/variables.tfvars" azuread_group.aad_groups_services[\`\"adm-xxx01\`\"] xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

问题 #

请问该问题是否与PowerShell解释器有关？

解答 #

是PowerShell的字符解析逻辑导致的问题。

原因分析 #

单条命令在控制台输入时，PowerShell能正确解析你手动输入的转义组合\"；但批量读取CSV内容时，CSV里的转义字符会被PowerShell处理，导致传递给Terraform的资源地址丢失了内层的双引号，变成了azuread_group.aad_groups_services[`adm-xxx01`]`，不符合Terraform的地址语法要求，因此报错。

解决方案 #

方案1：给资源地址加引号包裹

修改PowerShell命令，把拼接后的资源地址用双引号包裹，确保转义字符被正确传递：

Import-Csv .\import_groups.csv | ForEach-Object {
    terraform import -var-file="./variables/variables.tfvars" "azuread_group.$($_.GroupsName)" $($_.ObjectId)
}

方案2：简化CSV内容并动态添加转义

先修改import_groups.csv里的GroupsName字段，去掉多余转义：

"ObjectId","GroupsName"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[adm-xxx01]"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[exp-xxx01]"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[cod-xxx01]"
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","aad_groups_services[tec-xxx01]"

再在PowerShell中动态添加Terraform需要的转义字符：

Import-Csv .\import_groups.csv | ForEach-Object {
    # 替换[xxx]为[\`\"xxx\`\"]
    $targetAddr = "azuread_group.$($_.GroupsName -replace '\[(.*?)\]', '[\`\"$1\`\"]')"
    terraform import -var-file="./variables/variables.tfvars" $targetAddr $($_.ObjectId)
}

内容的提问来源于stack exchange，提问作者Cookies