使用Terraform基于现有镜像创建Azure VM时遇400错误求助

问题背景 #

使用包含预置osProfile（内置用户名和密码）的Azure共享镜像库镜像创建Windows虚拟机时，Terraform代码中指定admin_username和admin_password会触发Azure API返回400 Bad Request错误，提示"osProfile"不允许；但通过Azure CLI或门户可以正常创建虚拟机。

解决方案 #

方法1：调整azurerm_windows_virtual_machine资源配置 #

直接移除虚拟机资源块中的admin_username和admin_password字段，Terraform将不会向Azure API发送osProfile参数，与门户/CLI的请求逻辑保持一致。

修改后的虚拟机资源代码：

# Create virtual machine
resource "azurerm_windows_virtual_machine" "main" {
  name                  = "${var.prefix}-vm"
  location              = azurerm_resource_group.rg.location
  resource_group_name   = azurerm_resource_group.rg.name
  network_interface_ids = [azurerm_network_interface.my_terraform_nic.id]
  size                  = "Standard_DS1_v2"
  source_image_id       = "/subscriptions/9c28955b-a2e9-411a-a3bf-b9c4c53f531e/resourceGroups/myGalleryRG/providers/Microsoft.Compute/galleries/myGallery/images/ACC_base_image/versions/1.0.0"

  os_disk {
    name                 = "myOsDisk"
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
  }

  boot_diagnostics {
    storage_account_uri = azurerm_storage_account.my_storage_account.primary_blob_endpoint
  }
}

如果Terraform报错提示admin_username或admin_password为必填项，可将字段设为null并添加lifecycle块忽略这些字段的变更：

# Create virtual machine
resource "azurerm_windows_virtual_machine" "main" {
  name                  = "${var.prefix}-vm"
  admin_username        = null
  admin_password        = null
  location              = azurerm_resource_group.rg.location
  resource_group_name   = azurerm_resource_group.rg.name
  network_interface_ids = [azurerm_network_interface.my_terraform_nic.id]
  size                  = "Standard_DS1_v2"
  source_image_id       = "/subscriptions/9c28955b-a2e9-411a-a3bf-b9c4c53f531e/resourceGroups/myGalleryRG/providers/Microsoft.Compute/galleries/myGallery/images/ACC_base_image/versions/1.0.0"

  os_disk {
    name                 = "myOsDisk"
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
  }

  boot_diagnostics {
    storage_account_uri = azurerm_storage_account.my_storage_account.primary_blob_endpoint
  }

  lifecycle {
    ignore_changes = [admin_username, admin_password]
  }
}

方法2：使用通用azurerm_virtual_machine资源 #

如果方法1仍存在问题，可切换到更灵活的通用虚拟机资源类型，它允许完全不指定osProfile相关配置，适配已有预置账号的镜像：

# Create virtual machine
resource "azurerm_virtual_machine" "main" {
  name                  = "${var.prefix}-vm"
  location              = azurerm_resource_group.rg.location
  resource_group_name   = azurerm_resource_group.rg.name
  network_interface_ids = [azurerm_network_interface.my_terraform_nic.id]
  vm_size               = "Standard_DS1_v2"

  storage_image_reference {
    id = "/subscriptions/9c28955b-a2e9-411a-a3bf-b9c4c53f531e/resourceGroups/myGalleryRG/providers/Microsoft.Compute/galleries/myGallery/images/ACC_base_image/versions/1.0.0"
  }

  storage_os_disk {
    name              = "myOsDisk"
    caching           = "ReadWrite"
    create_option     = "FromImage"
    managed_disk_type = "Premium_LRS"
  }

  boot_diagnostics {
    storage_account_uri = azurerm_storage_account.my_storage_account.primary_blob_endpoint
  }
}

内容的提问来源于stack exchange，提问作者CloudCrusader