Terraform部署Azure应用网关遇InvalidResourceReference报错排查

错误原因 #

你在backend_http_settings的trusted_root_certificate_names字段中直接引用了Key Vault Secret的名称，但Azure应用网关的可信根证书需要先在应用网关资源内定义对应的trusted_root_certificate块，才能在后端设置中引用。直接引用Key Vault资源名称会导致网关找不到对应的内部资源，从而抛出InvalidResourceReference错误。

修复步骤 #

1. 从Key Vault读取证书的原始内容（需为PEM格式的CER证书）
2. 在应用网关内添加trusted_root_certificate块，将Key Vault中的证书内容导入
3. 在backend_http_settings中引用这个内部可信根证书的名称

修改后的完整代码示例 #

data "azurerm_key_vault_secret" "intdev-api-cer" {
  name         = "intdev-api-cer"
  key_vault_id = data.azurerm_key_vault.nw-kv-ie1.id
}

data "azurerm_key_vault_certificate" "intdev-api" {
  name         = "intdev-api"
  key_vault_id = data.azurerm_key_vault.nw-kv-ie1.id
}

resource "azurerm_application_gateway" "appgw1" {
  # 保留你原有的其他配置（如名称、资源组、区域等）
  .......

  # 新增：定义应用网关内部的可信根证书
  trusted_root_certificate {
    name = "TrustedRoot-intdev-api"
    data = base64decode(data.azurerm_key_vault_secret.intdev-api-cer.value)
  }

  backend_address_pool {
    name         = "Backendpool-intdev-api"
    ip_addresses = ["X.X.X.X", "X.X.X.X"]
  }

  backend_http_settings {
    name                           = "Backendsettings-intdev-api"
    cookie_based_affinity          = "Disabled"
    path                           = "/"
    port                           = 443
    protocol                       = "Https"
    request_timeout                = 60
    host_name                      = "intdev-api.xxx.com"
    probe_name                     = "Healthprobe-intdev-api"
    # 修改：引用应用网关内部的可信根证书名称
    trusted_root_certificate_names = ["TrustedRoot-intdev-api"]
  }

  ssl_certificate {
    name                = data.azurerm_key_vault_certificate.intdev-api.name
    key_vault_secret_id = data.azurerm_key_vault_certificate.intdev-api.secret_id
  }

  http_listener {
    name                           = "Listener-intdev-api"
    frontend_ip_configuration_name = "xyz"
    frontend_port_name             = "abc"
    protocol                       = "Https"
    host_name                      = "intdev-api.xxx.com"
    ssl_certificate_name           = data.azurerm_key_vault_certificate.intdev-api.name
  }

  request_routing_rule {
    name                       = "Rule-intdev-api"
    rule_type                  = "Basic"
    http_listener_name         = "Listener-intdev-api"
    backend_address_pool_name  = "Backendpool-intdev-api"
    backend_http_settings_name = "Backendsettings-intdev-api" # 修正原代码拼写错误：Backendsetting → Backendsettings
    priority                   = 3
  }

  probe {
    name                                      = "Healthprobe-intdev-api"
    protocol                                  = "Https"
    pick_host_name_from_backend_http_settings = true
    path                                      = "/"
    interval                                  = 30
    timeout                                   = 30
    unhealthy_threshold                       = 3
  }
}

额外注意点 #

• 确认Key Vault中的intdev-api-cer secret存储的是Base64编码的PEM格式CER证书，如果是原始二进制证书，需确保base64decode能正确解析
• 原代码中request_routing_rule的backend_http_settings_name字段存在拼写错误，会导致配置找不到后端设置资源，需一并修正

内容的提问来源于stack exchange，提问作者Sagar Hiremath