使用Terraform配置Azure Data Factory CMK遇死锁问题求助

问题根源 #

1. 创建时权限错误：系统托管身份（MI）在Data Factory创建后才生成，导致创建带CMK的ADF时，MI还没有Key Vault的访问权限。
2. 更新CMK失败：Azure官方限制只能在Data Factory创建时配置CMK，已存在的ADF（即使删除默认集成运行时）无法再启用CMK，这是触发Updatefactory failed.You cannot add CMK settings for factories with existing entities错误的核心原因。

解决方案1：使用用户托管身份（推荐） #

用户托管身份可提前创建并配置Key Vault权限，彻底避免循环依赖：

# 1. 创建资源组
resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

# 2. 创建用户托管身份
resource "azurerm_user_assigned_identity" "adf_identity" {
  name                = "adf-user-identity"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
}

# 3. 配置Key Vault访问策略，允许身份访问CMK
resource "azurerm_key_vault_access_policy" "adf_cmk_access" {
  key_vault_id = var.key_vault_id # 替换为你的Key Vault ID
  tenant_id    = azurerm_user_assigned_identity.adf_identity.tenant_id
  object_id    = azurerm_user_assigned_identity.adf_identity.principal_id

  key_permissions = [
    "Get",
    "WrapKey",
    "UnwrapKey",
  ]
}

# 4. 创建带CMK的Data Factory
resource "azurerm_data_factory" "example" {
  name                = "example"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  # 关联用户托管身份
  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.adf_identity.id]
  }

  # 配置CMK，依赖访问策略生效
  customer_managed_key_id          = var.cmk_id # 替换为你的CMK ID
  customer_managed_key_identity_id = azurerm_user_assigned_identity.adf_identity.id

  depends_on = [azurerm_key_vault_access_policy.adf_cmk_access]
}

解决方案2：分阶段创建（系统托管身份） #

如果必须使用系统托管身份，需分三步执行Terraform：

步骤1：创建不带CMK的ADF（生成系统托管身份） #

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_data_factory" "example" {
  name                = "example"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  # 启用系统托管身份
  identity {
    type = "SystemAssigned"
  }
}

执行terraform apply完成ADF创建，此时会自动生成系统托管身份。

步骤2：配置Key Vault访问策略 #

在代码中新增访问策略资源：

resource "azurerm_key_vault_access_policy" "adf_cmk_access" {
  key_vault_id = var.key_vault_id
  tenant_id    = azurerm_data_factory.example.identity[0].tenant_id
  object_id    = azurerm_data_factory.example.identity[0].principal_id

  key_permissions = [
    "Get",
    "WrapKey",
    "UnwrapKey",
  ]
}

执行terraform apply完成权限配置。

步骤3：销毁旧ADF，重建带CMK的ADF #

修改ADF资源，添加CMK配置：

resource "azurerm_data_factory" "example" {
  name                = "example"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  identity {
    type = "SystemAssigned"
  }

  customer_managed_key_id          = var.cmk_id
  customer_managed_key_identity_id = azurerm_data_factory.example.identity[0].principal_id

  depends_on = [azurerm_key_vault_access_policy.adf_cmk_access]
}

先执行terraform destroy -target azurerm_data_factory.example销毁旧ADF，再执行terraform apply创建带CMK的新ADF。

关键注意事项 #

• Key Vault与Data Factory必须处于同一Azure区域，CMK需为RSA类型密钥。
• 访问策略必须包含Get、WrapKey、UnwrapKey三个权限，否则ADF无法完成加密操作。

内容的提问来源于stack exchange，提问作者Asterix