Terraform跨Azure订阅部署报错：Bad Request - Invalid URL

使用Terraform通过Service Principal在多个Azure订阅部署虚拟资源时，仅其中一个订阅部署失败，报错如下：

▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ Terraform Apply ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼ ▼
Acquiring state lock. This may take a few moments...
data.azurerm_key_vault.compute_lab: Reading...
data.azurerm_resource_group.image: Reading...
data.azurerm_shared_image.image: Reading...
data.azurerm_resource_group.image: Read complete after 0s [id=/subscriptions/((redacted))/resourceGroups/Packer]
data.azurerm_shared_image.image: Read complete after 1s [id=/subscriptions/((redacted))/resourceGroups/Packer/providers/Microsoft.Compute/galleries/cycloid/images/Windows-server-2019]
data.azurerm_key_vault.compute_lab: Read complete after 1s [id=/subscriptions/((redacted))/resourceGroups/COMPUTE-LAB-COM/providers/Microsoft.KeyVault/vaults/COMPUTE-LAB]
╷
│ Warning: Invalid index:The given key does not identify an element in this collection value.
│ 
│ 
╵
╷
│ Error: Unable to list provider registration status, it is possible that this is due to invalid credentials or the service principal does not have permission to use the Resource Manager API, Azure error: resources.ProvidersClient#List: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: error response cannot be parsed: {"\r\n\r\n\r
Bad Request - Invalid URL
\r
HTTP Error 400. The request URL is invalid.

\r\n\r\n" '\x00' '\x00'} error: invalid character '<' looking for beginning of value
│ 
│   with provider["registry.terraform.io/hashicorp/azurerm"],
│   on main.tf line 1, in provider "azurerm":
│    1: provider "azurerm" {
│ 
╵

Releasing state lock. This may take a few moments...
▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ Terraform Apply ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲ ▲
Failed To Run Terraform Apply!
2023/05/31 08:28:43 Apply Error: Failed to run Terraform command: exit status 1

操作仅需连接订阅并部署所需资源。

使用版本：

• Azure RM Terraform Provider：3.54.0
• Terraform：v1.4.6

已排查内容：

• Service Principal凭证正确
• 所有订阅的Service Principal权限一致
• 订阅中资源提供商配置一致且正常
• 无网络问题

代码片段：

versions.tf #

##################################################################################
# VERSIONS
##################################################################################

terraform {
  backend "azurerm" {
  }
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.54.0"
    }
    /*
    netbox = {
      source  = "e-breuninger/netbox"
      version = "1.5.1"
    }*/
    awx = {
      source  = "nolte/awx"
      version = "0.2.2"
    }

    }
}

main.tf #

provider "azurerm" {
  features {}
}

provider "azurerm" {
  skip_provider_registration = "true"
  features {}

  alias           = "common-services"
  subscription_id = var.common_services_id
}

resource "random_password" "admin_pwd" {
  length           = 16
  special          = true
  override_special = "!#$%&*()-_=+[]{}<>?:?"
}


data "azurerm_resource_group" "" {
  name = var.resource_group
}


## Import Key vault informations ##
data "azurerm_key_vault" "compute_lab" {
  provider            = azurerm.common-services
  name                = var.key_vault_name
  resource_group_name = var.resource_group_keyvault
}

1. 为默认Provider指定订阅ID
   报错指向第1行的默认azurerm Provider，该Provider未指定subscription_id，可能导致Terraform使用错误的订阅上下文。修改默认Provider配置，添加目标订阅ID：

   provider "azurerm" {
     features {}
     subscription_id = var.target_subscription_id # 替换为出问题的订阅ID变量或直接值
   }
   

2. 统一设置skip_provider_registration
   仅别名Provider开启了skip_provider_registration = "true"，默认Provider未设置。由于已确认资源提供商配置正常，为默认Provider也添加该参数，避免Terraform尝试检查/注册提供商：

   provider "azurerm" {
     features {}
     subscription_id = var.target_subscription_id
     skip_provider_registration = true # 建议使用布尔值，原字符串"true"也可兼容
   }
   

3. 修复空名称的数据源
   data "azurerm_resource_group" "" 存在空名称问题，对应报错中的"Invalid index"警告。为该数据源添加合理名称：

   data "azurerm_resource_group" "main" {
     name = var.resource_group
   }
   

4. 检查Backend配置的订阅上下文
   Terraform Backend使用azurerm类型，若未指定订阅ID，会使用当前Azure CLI或环境变量的默认订阅。确保Backend配置的订阅与目标订阅一致，或显式指定：

   terraform {
     backend "azurerm" {
       subscription_id = "your-target-subscription-id"
       resource_group_name = "your-backend-rg"
       storage_account_name = "your-storage-account"
       container_name = "tfstate"
     }
   }
   

5. 验证环境变量中的订阅配置
   若使用环境变量（如ARM_SUBSCRIPTION_ID）传递订阅信息，确保该变量值为出问题的订阅ID，且未被其他脚本或会话覆盖。

内容的提问来源于stack exchange，提问作者alphax