Terraform创建Azure应用配置特征时权限传播超时问题求助

问题 #

尝试通过Terraform创建Azure应用配置并添加两个功能标志时，遇到权限超时错误：

│
│   with module.appconfig.azurerm_app_configuration_feature.advanced,
│   on app_config\main.tf line 27, in resource "azurerm_app_configuration_feature" "keyname":│   27: resource "azurerm_app_configuration_feature" "keyname" {
│
│ waiting for App Configuration Key ".appconfig.featureflag/keyname" read permission to be propagated: timeout while waiting for state to become 'Error, Exists' (last state: 'Forbidden', timeout: 44m59.3893417s)   
╵

使用的Terraform代码片段：

data "azurerm_client_config" "data" {
}

resource "azurerm_resource_group" "test" {
  name     = "rg-sample-4"
  location = "eastus"
}

resource "azurerm_role_assignment" "app_configuration_role" {
  scope                = azurerm_resource_group.test.id
  role_definition_name = "App Configuration Data Owner"
  principal_id         = data.azurerm_client_config.data.object_id
}

resource "azurerm_app_configuration" "this" {
  name                       = "appconfig-94"
  resource_group_name        = "rg-sample-4"
  location                   = "eastus"
  sku                        = var.APP_CONFIGURATION_SKU
  local_auth_enabled         = var.APP_CONFIGURATION_LOCAL_AUTH_ENABLED #true
  public_network_access      = var.APP_CONFIGURATION_PUBLIC_NETWORK_ACCESS #"Enabled"
  purge_protection_enabled   = var.APP_CONFIGURATION_PURGE_PROTECTION_ENABLED #false
  soft_delete_retention_days = var.APP_CONFIGURATION_SOFT_DELETE_RETENTION_DAYS #1

  depends_on = [
    azurerm_role_assignment.app_configuration_role,
  ]
}

resource "azurerm_app_configuration_feature" "keyname" {
  configuration_store_id = azurerm_app_configuration.this.id
  description            = var.ADVANCED_FEATURE_DESCRIPTION
  name                   = var.ADVANCED_FEATURE_NAME
  label                  = var.ADVANCED_FEATURE_LABEL
  enabled                = var.ADVANCED_FEATURE_ENABLED
}

resource "azurerm_app_configuration_feature" "keynametwo" {
  configuration_store_id = azurerm_app_configuration.this.id
  description            = var.EXTENSION_FEATURE_DESCRIPTION
  name                   = var.EXTENSION_FEATURE_NAME
  label                  = var.EXTENSION_FEATURE_LABEL
  enabled                = var.EXTENSION_FEATURE_ENABLED
}

使用的azurerm provider版本：

azurerm = {
      source  = "hashicorp/azurerm"
      version = "=3.52.0"
    }

原因分析 #

1. 角色分配作用域错误：当前角色分配作用于资源组级别，但Azure应用配置的数据权限需要直接绑定到应用配置实例本身。资源组级别的权限传播到实例存在延迟，且可能无法及时生效。
2. 依赖关系逻辑倒置：现有代码让应用配置实例依赖角色分配，但实际角色分配需要先有应用配置实例才能绑定，导致依赖关系逻辑错误，权限无法正确关联。
3. Provider版本Bug：3.52.0版本的azurerm provider可能存在权限传播状态检测的问题，导致超时判断异常。

修复方案 #

方案1：调整角色分配作用域与依赖关系 #

将角色分配直接绑定到应用配置实例，修正依赖逻辑：

data "azurerm_client_config" "data" {
}

resource "azurerm_resource_group" "test" {
  name     = "rg-sample-4"
  location = "eastus"
}

resource "azurerm_app_configuration" "this" {
  name                       = "appconfig-94"
  resource_group_name        = "rg-sample-4"
  location                   = "eastus"
  sku                        = var.APP_CONFIGURATION_SKU
  local_auth_enabled         = var.APP_CONFIGURATION_LOCAL_AUTH_ENABLED
  public_network_access      = var.APP_CONFIGURATION_PUBLIC_NETWORK_ACCESS
  purge_protection_enabled   = var.APP_CONFIGURATION_PURGE_PROTECTION_ENABLED
  soft_delete_retention_days = var.APP_CONFIGURATION_SOFT_DELETE_RETENTION_DAYS
}

# 角色分配绑定到应用配置实例，依赖实例先创建
resource "azurerm_role_assignment" "app_configuration_role" {
  scope                = azurerm_app_configuration.this.id
  role_definition_name = "App Configuration Data Owner"
  principal_id         = data.azurerm_client_config.data.object_id

  depends_on = [azurerm_app_configuration.this]
}

# 功能标志依赖角色分配完成
resource "azurerm_app_configuration_feature" "keyname" {
  configuration_store_id = azurerm_app_configuration.this.id
  description            = var.ADVANCED_FEATURE_DESCRIPTION
  name                   = var.ADVANCED_FEATURE_NAME
  label                  = var.ADVANCED_FEATURE_LABEL
  enabled                = var.ADVANCED_FEATURE_ENABLED

  depends_on = [azurerm_role_assignment.app_configuration_role]
}

resource "azurerm_app_configuration_feature" "keynametwo" {
  configuration_store_id = azurerm_app_configuration.this.id
  description            = var.EXTENSION_FEATURE_DESCRIPTION
  name                   = var.EXTENSION_FEATURE_NAME
  label                  = var.EXTENSION_FEATURE_LABEL
  enabled                = var.EXTENSION_FEATURE_ENABLED

  depends_on = [azurerm_role_assignment.app_configuration_role]
}

方案2：添加权限传播延迟（可选） #

如果仍然遇到超时，添加time_sleep资源给权限传播留足时间：

# 在角色分配后添加延迟
resource "time_sleep" "role_propagation" {
  create_duration = "60s" # 根据实际情况调整时长

  depends_on = [azurerm_role_assignment.app_configuration_role]
}

# 修改功能标志的依赖为time_sleep
resource "azurerm_app_configuration_feature" "keyname" {
  # ... 其他配置不变
  depends_on = [time_sleep.role_propagation]
}

resource "azurerm_app_configuration_feature" "keynametwo" {
  # ... 其他配置不变
  depends_on = [time_sleep.role_propagation]
}

方案3：升级Provider版本 #

将azurerm provider升级到3.60.0及以上版本，修复可能存在的权限检测bug：

azurerm = {
      source  = "hashicorp/azurerm"
      version = ">=3.60.0"
    }

内容的提问来源于stack exchange，提问作者visualreactor