如何通过Terraform关联PowerBI Embedded容量与PowerBI工作区？

问题场景 #

使用以下Terraform代码创建PowerBI Embedded容量并关联PowerBI工作区：

resource "azurerm_powerbi_embedded" "powerbi" {
  count               = var.environment != "dev" ? 0 : 1
  name                = "biarm${var.app_name}${var.environment}"
  location            = var.location
  resource_group_name = "rg-arm-${var.app_name}-${var.environment}"
  sku_name            = "A1"
  mode                = "Gen2"
  administrators      = [module.pbi_object_id.env_shared_kv_secret_value, data.azuread_client_config.current.object_id]
  provider            = azurerm.saas-shared
}

provider "powerbi" {
  tenant_id     = data.azuread_client_config.current.tenant_id
  client_id     = module.pbi_client_id.env_shared_kv_secret_value
  client_secret = module.pbi_secret.env_shared_kv_secret_value
}

resource "powerbi_workspace" "myworkspace" {
  name        = "Workspace for ${var.environment}-${var.location}-${var.instance_number}"
  capacity_id = azurerm_powerbi_embedded.powerbi.id
}

运行后触发错误：

│ Error: Capacity id /subscriptions/xxxxxxx-9a95-4b71-8290-0f8b11f4d5f5/resourceGroups/rg-arm-shared-dev/providers/Microsoft.PowerBIDedicated/capacities/biarmshareddev not found or logged-in user doesn't have capacity admin rights
│
│   with powerbi_workspace.myworkspace,
│   on power-bi.tf line 61, in resource "powerbi_workspace" "myworkspace":
│   61: resource "powerbi_workspace" "myworkspace" {

核心矛盾：azurerm_powerbi_embedded仅暴露Azure资源ID格式的id属性，但powerbi_workspace需要GUID格式的容量ID。

解决方案 #

可以在Terraform内完成关联，无需手动在PowerBI门户操作，分两种情况处理：

情况1：使用AzureRM Provider >=3.0 #

新版本的AzureRM Provider为azurerm_powerbi_embedded资源新增了capacity_id属性，直接返回PowerBI服务所需的GUID格式容量ID，修改代码如下：

resource "powerbi_workspace" "myworkspace" {
  name        = "Workspace for ${var.environment}-${var.location}-${var.instance_number}"
  capacity_id = azurerm_powerbi_embedded.powerbi.capacity_id
}

情况2：使用旧版本AzureRM Provider #

若无法升级Provider，可通过external数据源调用Azure CLI获取GUID格式的容量ID：

data "external" "pbi_capacity_guid" {
  program = [
    "az",
    "powerbi",
    "embedded-capacity",
    "show",
    "--name", azurerm_powerbi_embedded.powerbi.name,
    "--resource-group", azurerm_powerbi_embedded.powerbi.resource_group_name,
    "--query", "properties.capacityId",
    "-o", "tsv"
  ]
}

resource "powerbi_workspace" "myworkspace" {
  name        = "Workspace for ${var.environment}-${var.location}-${var.instance_number}"
  capacity_id = data.external.pbi_capacity_guid.result
}

额外权限校验 #

确保powerbi provider使用的服务主体已被添加到azurerm_powerbi_embedded的administrators列表中，即代码中module.pbi_object_id.env_shared_kv_secret_value对应的是该服务主体的Object ID，避免触发权限不足的错误。

内容的提问来源于stack exchange，提问作者Alexey Auslender