Terraform变量验证错误：跨变量引用致初始化失败

问题根源 #

Terraform的变量验证规则明确：单个变量的validation块只能引用自身，不能引用其他变量。你在capacity和zone_redundant的验证条件里调用var.sku，违反了这个规则，所以触发了初始化错误。

可行解决方案 #

方案1：资源级前置验证（推荐，不改变原有变量结构） #

把跨变量的验证逻辑移到资源块的precondition中，这里可以自由引用所有变量，同时保留原有变量的定义方式。

修改main.tf，给Service Bus资源添加前置验证：

resource "azurerm_servicebus_namespace" "servicebus_namespace" {
  name                          = regex("^[-\\w\\._\\(\\)]+$", substr("sbns-${var.environment_name}-${var.application_name}-${var.location}", 0, 50))
  resource_group_name           = var.resource_group_name
  location                      = var.location
  sku                           = var.sku
  capacity                      = var.capacity
  tags                          = local.tags
  public_network_access_enabled = false
  minimum_tls_version           = "1.2"
  local_auth_enabled            = false
  identity                      = var.identity
  customer_managed_key {
    key_vault_key_id = var.key_vault_key_id
    identity_id      = var.identity_id
  }

  # 验证capacity与sku的匹配关系
  precondition {
    condition     = var.sku == "Premium" ? can(index([1, 2, 4, 8, 16], var.capacity)) : var.capacity == 0
    error_message = "容量值无效：Premium SKU仅支持1/2/4/8/16；Basic/Standard SKU必须设为0。"
  }

  # 验证zone_redundant与sku的匹配关系
  precondition {
    condition     = var.sku == "Premium" ? var.zone_redundant : !var.zone_redundant
    error_message = "区域冗余配置无效：Premium SKU必须启用区域冗余；Basic/Standard SKU必须禁用。"
  }
}

然后修改variables.tf，移除这两个变量的跨变量验证块，只保留基础校验（可选）：

variable "capacity" {
  type        = number
  description = "(Optional) Specifies the capacity. When sku is Premium, capacity can be 1, 2, 4, 8, or 16. When sku is Basic or Standard, capacity can be 0 only."
  default     = 0

  # 仅做基础范围校验
  validation {
    condition     = var.capacity >= 0
    error_message = "容量不能为负数。"
  }
}

variable "zone_redundant" {
  type        = bool
  description = "(Optional) Whether or not this resource is zone redundant. sku needs to be Premium. Changing this forces a new resource to be created."
  default     = false
}

方案2：合并相关变量为对象类型 #

把sku、capacity、zone_redundant打包成一个对象变量，这样在变量验证中可以引用对象内部的其他属性，强制调用方按规则组合参数。

修改variables.tf，新增对象变量：

variable "servicebus_sku_config" {
  type = object({
    sku            = string
    capacity       = number
    zone_redundant = bool
  })
  description = "Service Bus SKU配置：Premium SKU需搭配1/2/4/8/16容量并启用区域冗余；Basic/Standard SKU需搭配0容量并禁用区域冗余。"
  default = {
    sku            = "Standard"
    capacity       = 0
    zone_redundant = false
  }

  validation {
    condition = (
      (var.servicebus_sku_config.sku == "Premium" && can(index([1,2,4,8,16], var.servicebus_sku_config.capacity)) && var.servicebus_sku_config.zone_redundant) ||
      (contains(["Basic", "Standard"], var.servicebus_sku_config.sku) && var.servicebus_sku_config.capacity == 0 && !var.servicebus_sku_config.zone_redundant)
    )
    error_message = "SKU配置无效：请确保容量和区域冗余设置与所选SKU层级匹配。"
  }
}

# 移除原有的sku、capacity、zone_redundant变量

修改main.tf引用对象属性：

resource "azurerm_servicebus_namespace" "servicebus_namespace" {
  name                          = regex("^[-\\w\\._\\(\\)]+$", substr("sbns-${var.environment_name}-${var.application_name}-${var.location}", 0, 50))
  resource_group_name           = var.resource_group_name
  location                      = var.location
  sku                           = var.servicebus_sku_config.sku
  capacity                      = var.servicebus_sku_config.capacity
  zone_redundant                = var.servicebus_sku_config.zone_redundant
  tags                          = local.tags
  public_network_access_enabled = false
  minimum_tls_version           = "1.2"
  local_auth_enabled            = false
  identity                      = var.identity
  customer_managed_key {
    key_vault_key_id = var.key_vault_key_id
    identity_id      = var.identity_id
  }
}

调用模块时的写法改为：

module "servicebus_namespace" {
  source              = "./.."
  location            = "australiaeast"
  environment_name    = "dev"
  department          = "Data Services"
  cost_centre         = "ABC101"
  application_name    = "demo"
  resource_group_name = "rg-dev-demo-australiaeast"
  servicebus_sku_config = {
    sku            = "Standard"
    capacity       = 0
    zone_redundant = false
  }
}

方案对比 #

• 方案1：保留原有变量结构，对调用方友好，验证逻辑贴近资源创建环节，适合需要保持变量独立性的场景。
• 方案2：强制参数组合规则，减少调用方出错概率，但会改变原有调用方式，适合需要严格约束配置的场景。

内容的提问来源于stack exchange，提问作者learner