Terraform未指定却将资源值置为null的异常问题求助

此前使用Terraform从未遇到该异常：每次执行terraform plan时均提示需替换资源，因此添加了lifecycle { ignore_changes = all }配置。执行terraform apply时，计划显示会将fqdn、IP地址或guid置为null，但实际并未修改；但apply完成后再次执行plan，仍会出现相同的资源更新提示。该问题已出现在数十个资源上，无法排查原因。

配置片段 #

SQL托管实例与私有端点配置 #

#SQL MANAGED INSTANCE
resource "azurerm_mssql_managed_instance" "main" {
  name                = local.SQLInstanceName
  resource_group_name = var.RG.name
  location            = var.SQLMIInfo.Location

  identity {
    type = "SystemAssigned"
  }

  lifecycle {
    ignore_changes = all
  }

  license_type       = "BasePrice"
  subnet_id          = data.azurerm_subnet.SQL.id
  sku_name           = var.SQLMIInfo.Sku
  storage_size_in_gb = var.SQLMIInfo.StorageGB
  vcores             = var.SQLMIInfo.VCores
  storage_account_type = var.SQLMIInfo.StorageType

  collation = "Latin1_General_CI_AS"

  administrator_login          = var.Secrets.SQLMIAdminAccount
  administrator_login_password = "${data.azurerm_key_vault_secret.SQLAdmin.value}"

  public_data_endpoint_enabled = false

  depends_on = [
    null_resource.delegation,
  ]
}

data "azurerm_subnet" "endpoint" {
  name                 = "Hub-Private-Endpoint-Subnet"
  virtual_network_name = "${var.RGInfo.Env}-01-HUB-VNET"
  resource_group_name  = "RG-${var.RGInfo.Env}-01-HUB"
}

resource "azurerm_private_endpoint" "main" {
  name                = local.PrivateEndpointName
  location            = "West Europe"
  resource_group_name = var.RG.name
  subnet_id           = data.azurerm_subnet.endpoint.id
  custom_network_interface_name  = "${local.PrivateEndpointName}-nic"
  private_service_connection {
    name                           = local.PrivateEndpointName
    is_manual_connection           = false
    private_connection_resource_id = azurerm_mssql_managed_instance.main.id
    subresource_names = ["managedInstance"]
  }

  lifecycle {
    ignore_changes = all
  }
}

Plan输出的更新内容 #

# module.WE-DBOU.module.SQLInstances["we-sqlmi-gfndbou-imp-01"].azurerm_mssql_managed_instance.main must be replaced
-/+ resource "azurerm_mssql_managed_instance" "main" {
      ~ administrator_login_password   = (sensitive value)
      - dns_zone_partner_id            = "" -> null
      ~ fqdn                           = "pilot-08-we-sqlmi-gfndbou-imp-01.database.windows.net" -> (known after apply)
      ~ id                             = "/suensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Sql/managedInstances/pilot-08-we-sqlmi-gfndbou-imp-01" -> (known after apply)
        name                           = "pilot-08-we-sqlmi-gfndbou-imp-01"
      ~ subnet_id                      = "sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Network/virtualNetworks/PILOT-08-WE-DBOU-VNET/subnets/we-sqlmi-gfndbou-imp-01-Subnet" -> (known after apply) # forces replacement
      - tags                           = {} -> null
        # (14 unchanged attributes hidden)

      ~ identity {
          ~ principal_id = "97a84a7b-8u3wu9u9u2-283u82uuu91u2991" -> (known after apply)
          ~ tenant_id    = "97a84a7b-8u3wu9u9u2-283u82uuu91u2991" -> (known after apply)
            # (1 unchanged attribute hidden)
        }
    }

  # module.WE-DBOU.module.SQLInstances["we-sqlmi-gfndbou-imp-01"].azurerm_private_dns_zone.db-dns will be updated in-place
  ~ resource "azurerm_private_dns_zone" "db-dns" {
        id                                                    = "/sensitive/resourceGroups/RG-PILOT-01-HUB/providers/Microsoft.Network/privateDnsZones/privatelink.database.windows.net"
      - max_number_of_record_sets                             = 25000 -> null
      - max_number_of_virtual_network_links                   = 1000 -> null
      - max_number_of_virtual_network_links_with_registration = 100 -> null
        name                                                  = "privatelink.database.windows.net"
      - number_of_record_sets                                 = 1 -> null
        tags                                                  = {}
        # (1 unchanged attribute hidden)

      ~ soa_record {
          - fqdn          = "privatelink.sensitive.database.windows.net." -> null
          - host_name     = "azureprivatedns.net" -> null
          - serial_number = 1 -> null
            tags          = {}
            # (6 unchanged attributes hidden)
        }
    }

  # module.WE-DBOU.module.SQLInstances["we-sqlmi-gfndbou-imp-01"].azurerm_private_endpoint.main must be replaced
-/+ resource "azurerm_private_endpoint" "main" {
      ~ custom_dns_configs            = [
          - {
              - fqdn         = "pilot-08-we-sqlmi-gfndbou-imp-01.database.windows.net"
              - ip_addresses = [
                  - "10.40.6.9",
                ]
            },
        ] -> (known after apply)
      ~ id                            = "/sensitive/sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Network/privateEndpoints/pilot-08-we-dbou-import-01" -> (known after apply)
        name                          = "pilot-08-we-dbou-import-01"
      ~ network_interface             = [
          - {
              - id   = "/sensitive/sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Network/networkInterfaces/pilot-08-we-dbou-import-01-nic"
              - name = "pilot-08-we-dbou-import-01-nic"
            },
        ] -> (known after apply)
      ~ private_dns_zone_configs      = [] -> (known after apply)
      ~ subnet_id                     = "/sensitive/sensitive/resourceGroups/RG-PILOT-01-HUB/providers/Microsoft.Network/virtualNetworks/PILOT-01-HUB-VNET/subnets/Hub-Private-Endpoint-Subnet" -> (known after apply) # forces replacement
      - tags                          = {} -> null
        # (3 unchanged attributes hidden)

      ~ private_service_connection {
            name                           = "pilot-08-we-dbou-import-01"
          ~ private_connection_resource_id = "/sensitive/sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Sql/managedInstances/pilot-08-we-sqlmi-gfndbou-imp-01" -> (known after apply) # forces replacement
          ~ private_ip_address             = "10.40.6.9" -> (known after apply)
            # (2 unchanged attributes hidden)
        }
    }

排查与解决方向 #

• 检查子网数据源一致性：重点看data.azurerm_subnet.SQL.id是否每次plan返回不同值。若子网的委托配置被外部修改，或数据源读取权限不足，会导致Terraform误判subnet_id变更，触发资源替换。
• 升级Terraform与AzureRM Provider：老版本Provider可能存在只读属性处理bug，导致误判资源需替换。升级到最新稳定版后重新测试。
• ignore_changes的局限性：对于标记为forces replacement的属性（如subnet_id），ignore_changes = all无法阻止替换提示，需先确认subnet_id是否真的存在变更，或数据源读取是否异常。
• 同步状态文件：执行terraform refresh手动同步本地状态与云端实际资源，再重新plan，排查是否因状态不一致导致的误判。
• 处理空值/空字符串差异：Plan中dns_zone_partner_id = "" -> null的变更提示，可能是Provider对空字符串与null的判断逻辑不一致导致。可在配置中显式设置dns_zone_partner_id = null，或升级Provider解决。
• 私有端点依赖链：私有端点依赖SQL托管实例的ID，若SQL实例被标记为需替换，私有端点会同步触发替换提示。优先解决SQL实例的问题，私有端点的提示可能随之消失。

内容的提问来源于stack exchange，提问作者Mahbub Rahman