Terragrunt DRY部署Azure资源组与Key Vault报错求助

作为Terragrunt新手，我希望利用其DRY（Don't Repeat Yourself）特性实现代码复用，仓库计划支持AWS、GCP、Azure三大云厂商，当前聚焦Azure场景，目标是部署包含Key Vault的资源组。

我通过tenant.hcl、subscription.hcl和env.hcl文件避免重复修改租户、订阅及环境相关值，但执行部署时遇到路径相关错误。在IaC/deployments/azure/subscription-test-1/dev/client-test/目录下运行terragrunt plan时出现如下错误：

系统找不到指定的路径。
time=2023-03-30T09:26:00+02:00 level=error msg=Unable to determine underlying exit code, so Terragrunt will exit with error code 1

仓库目录结构 #

IaC/
├─ deployments/
│  ├─ azure/
│  │  ├─ subscription-test-1/
│  │  │  ├─ dev/
│  │  │  │  ├─ client-test/
│  │  │  │  │  ├─ terragrunt.hcl
│  │  │  │  ├─ env.hcl
│  │  │  ├─ ppd/
│  │  │  ├─ subscription.hcl
│  │  ├─ subscription-test-2/
│  │  │  ├─ dev/
│  │  │  ├─ ppd/
│  │  ├─ subscription-test-3/
│  │  │  ├─ prd/
│  │  │  ├─ sbx/
│  ├─ aws/
│  ├─ gcp/
│  ├─ tenant.hcl
├─ modules/
│  ├─ aws/
│  ├─ azuread/
│  │  ├─ security-groups/
│  │  ├─ spn/
│  ├─ azurerm/
│  │  ├─ akv/
│  │  │  ├─ main.tf
│  │  │  ├─ variables.tf
│  │  ├─ rg/
│  │  │  ├─ main.tf
│  │  │  ├─ variables.tf
│  ├─ databricks/
│  ├─ gcp/
├─ project-templates/
│  ├─ aws/
│  ├─ azure/
│  │  ├─ project-template-solution-1/
│  │  │  ├─ akv.tf
│  │  │  ├─ main.tf
│  │  │  ├─ rg.tf
│  │  │  ├─ variables.tf
│  │  │  ├─ terragrunt.hcl
│  │  ├─ project-template-solution-2/
│  │  ├─ project-template-solution-3/
│  ├─ gcp/
├─ terragrunt.hcl

关键代码文件 #

IaC/terragrunt.hcl #

locals {
  # 自动加载订阅变量
  subscription_vars = read_terragrunt_config(find_in_parent_folders("subscription.hcl"))

  # 自动加载租户级变量
  tenant_var = read_terragrunt_config(find_in_parent_folders("tenant.hcl"))

  # 自动加载环境级变量
  env_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
  
  environment       = local.env_vars.locals.environment
  subscription_id   = local.subscription_vars.locals.subscription_id
}

IaC/modules/azurerm/akv/main.tf #

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.42.0"
    }
  }
}

# 配置Azure资源管理提供商
provider "azurerm" {
    subscription_id = var.azure_subscription_id
    tenant_id = var.azure_tenant_id
    features {
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }
}

# 创建Azure Key Vault
resource "azurerm_key_vault" "akv" {
  name                        = lower("${var.azure_project_code}-${var.azure_env_code}-akv-01")
  location                    = var.azure_resource_group_location
  resource_group_name         = var.azure_rg_name
  enabled_for_disk_encryption = true
  tenant_id                   = var.azure_tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false
  sku_name = "standard"
}

IaC/modules/azurerm/akv/variables.tf #

variable "azure_subscription_id" {
  type        = string
  description = "Azure订阅ID"
}

variable "azure_tenant_id" {
  type        = string
  description = "Azure租户ID"
}

variable "azure_rg_name" {
  type        = string
  description = "Azure资源组名称"
}

variable "azure_resource_group_location" {
  default = "west europe"
  description   = "资源组所在区域"
}

variable "azure_env_code" {
  type        = string
  description = "Azure环境代码"
}

variable "azure_project_code" {
  type        = string
  description = "Azure项目代码"
}

IaC/modules/azurerm/rg/main.tf #

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.42.0"
    }
  }
}

provider "azurerm" {
    subscription_id = var.azure_subscription_id
    tenant_id = var.azure_tenant_id
    features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

# 创建Azure资源组
resource "azurerm_resource_group" "rg" {
  name     = var.azure_rg_name
  location = var.azure_resource_group_location
}

IaC/modules/azurerm/rg/variables.tf #

variable "azure_subscription_id" {
  type        = string
  description = "Azure订阅ID"
}

variable "azure_tenant_id" {
  type        = string
  description = "Azure租户ID"
}

variable "azure_rg_name" {
  type        = string
  description = "Azure资源组名称"
}

variable "azure_resource_group_location" {
  default = "west europe"
  description   = "资源组所在区域"
}

IaC/project-templates/azure/project-template-solution-1/terragrunt.hcl #

include {
  path = find_in_parent_folders()
}

IaC/project-templates/azure/project-template-solution-1/akv.tf #

module "akv" {
    source                          ="../../modules/azurerm/akv/"
    azure_subscription_id           = var.azure_subscription_id
    azure_tenant_id                 = var.azure_tenant_id
    azure_rg_name                   = var.azure_rg_name
    azure_resource_group_location   = var.azure_resource_group_location
    azure_project_code              = var.azure_project_code
    azure_env_code                  = var.azure_env_code
}

IaC/project-templates/azure/project-template-solution-1/rg.tf #

module "rg" {
    source                          ="../../modules/azurerm/rg/"
    azure_subscription_id           = var.azure_subscription_id
    azure_tenant_id                 = var.azure_tenant_id
    azure_rg_name                   = var.azure_rg_name
    azure_resource_group_location   = var.azure_resource_group_location
}

IaC/project-templates/azure/project-template-solution-1/main.tf #

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.42.0"
    }
  }
}

provider "azurerm" {
    subscription_id = var.azure_subscription_id
    tenant_id = var.azure_tenant_id
    features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

IaC/project-templates/azure/project-template-solution-1/variables.tf #

variable "azure_subscription_id" {
  type        = string
  description = "Azure订阅ID"
}

variable "azure_tenant_id" {
  type        = string
  description = "Azure租户ID"
}

variable "azure_rg_name" {
  type        = string
  description = "Azure资源组名称"
}

variable "azure_resource_group_location" {
  default = "west europe"
  description   = "资源组所在区域"
}

variable "azure_env_code" {
  type        = string
  description = "Azure环境代码"
}

variable "azure_project_code" {
  type        = string
  description = "Azure项目代码"
}

IaC/deployments/azure/tenant.hcl #

locals {
    tenant_id = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
}

IaC/deployments/azure/subscription-test-1/subscription.hcl #

locals {
    subscription_id = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
}

IaC/deployments/azure/subscription-test-1/dev/env.hcl #

locals {
  environment = "dev"
}

问题总结 #

我尝试通过Terraform模块（modules目录）结合模板（project-templates目录）与Terragrunt实现IaC部署，当前目标是在Azure环境下部署包含Key Vault的资源组，但执行terragrunt plan时出现路径错误，请求协助解决。

内容的提问来源于stack exchange，提问作者Leanne Kami