Terraform中获取for_each创建的指定Subnet ID的技术问题

问题背景 #

在基于Terraform搭建AKS Hub-Spoke架构时，已成功创建虚拟网络和子网，但部署测试VM时遇到NIC创建失败的问题：由于通过for_each批量创建子网，无法正确提取用于VM的特定子网ID，报错提示需访问资源的特定实例。

错误原因分析 #

1. 子网引用Key不匹配：代码中尝试用azurerm_subnet.subnets["vm-subnet"].id获取子网ID，但在local.spoke_subnets定义里，VM子网的Key是vm-spoke，两者不一致导致无法找到目标子网。
2. 子网与VNet关联逻辑隐患：当前子网创建时，virtual_network_name使用each.value.name，虽当前配置中值与each.key一致，但未直接关联到azurerm_virtual_network.spokes资源，易出现关联错误。

解决方案 #

1. 修正子网ID引用 #

将NIC配置中的子网ID引用改为对应正确的Key：

subnet_id = azurerm_subnet.subnets["vm-spoke"].id

2. 修正子网与VNet的关联 #

为避免子网和VNet关联错误，修改azurerm_subnet.subnets的virtual_network_name，直接关联到对应的spoke虚拟网络资源：

resource "azurerm_subnet" "subnets" {
    for_each             = local.spoke_subnets
    name                 = each.key
    resource_group_name  = azurerm_resource_group.test.name
    # 改为关联到对应的spoke VNet资源，避免名称匹配错误
    virtual_network_name = azurerm_virtual_network.spokes[each.key].name
    address_prefixes     = each.value.address_space
}

3. 完整修改后的NIC配置 #

resource "azurerm_network_interface" "vm-nic" {
    name                 = "ty-vm-nic"
    location             = azurerm_resource_group.test.location
    resource_group_name  = azurerm_resource_group.test.name
    enable_ip_forwarding = true

    ip_configuration {
        name                          = "ty-vm-ip"
        # 修正为正确的子网Key
        subnet_id                     = azurerm_subnet.subnets["vm-spoke"].id
        private_ip_address_allocation = "Dynamic"
    }
}

扩展场景说明 #

如果后续需要为多个子网批量创建NIC和VM，可以给NIC资源也加上for_each，通过each.key关联对应子网，示例如下：

# 仅筛选出VM子网创建NIC
resource "azurerm_network_interface" "vm-nics" {
    for_each             = { for k, v in local.spoke_subnets : k => v if k == "vm-spoke" }
    name                 = "${each.key}-nic"
    location             = azurerm_resource_group.test.location
    resource_group_name  = azurerm_resource_group.test.name
    enable_ip_forwarding = true

    ip_configuration {
        name                          = "${each.key}-ip"
        subnet_id                     = azurerm_subnet.subnets[each.key].id
        private_ip_address_allocation = "Dynamic"
    }
}

# 对应批量创建VM
resource "azurerm_virtual_machine" "test-vms" {
    for_each             = azurerm_network_interface.vm-nics
    name                  = "${each.key}-vm"
    location              = azurerm_resource_group.test.location
    resource_group_name   = azurerm_resource_group.test.name
    network_interface_ids = [each.value.id]
    vm_size               = var.vmsize

    # 其余VM配置（镜像、磁盘、OS配置等）省略...
}

内容的提问来源于stack exchange，提问作者Code_Rookie