使用用户托管身份向Azure认证遇401错误的排查方法

原本通过ARM_...环境变量使用服务主体认证的Terraform代码，现在要改用构建代理VM的托管身份运行。当前TF代码如下：

provider "azurerm" {
  features {}
  alias                      = "ss101"
  use_msi                    = true
  client_id                  = "3...5"
  subscription_id            = "6...2"
  skip_provider_registration = true
}

module "vnet-peering" {
  for_each = local.app_vnets
  source   = "./vnet-peering"
  app_vnet = module.vnets[each.value.location].vnets[each.value.key]

  providers = {
    azurerm.ss101 = azurerm.ss101
  }
}

尝试添加client_secret = null后仍报错，错误信息：

│ Error: building account: could not acquire access token to parse claims: clientCredentialsToken: received HTTP status 401 with response: {"error":"invalid_client","error_description":"AADSTS7000215: Invalid client secret provided. Ensure the secret being sent in the request is the client secret value, not the client secret ID, for a secret added to app '3...5'.\r\nTrace ID: b55484dd-8dec-4b6f-89e4-6b22e24a2000\r\nCorrelation ID: 67880b22-e6e8-4382-8378-7b9ea8702cdd\r\nTimestamp: 2023-03-17 19:21:20Z","error_codes":[7000215],"timestamp":"2023-03-17 19:21:20Z","trace_id":"b55484dd-8dec-4b6f-89e4-6b22e24a2000","correlation_id":"67880b22-e6e8-4382-8378-7b9ea8702cdd","error_uri":"https://login.microsoftonline.com/error?code=7000215"}
│ 
│   with module.bootstrap.provider["registry.terraform.io/hashicorp/azurerm"].ss101,
│   on .terraform/modules/bootstrap/main.tf line 185, in provider "azurerm":
│  185: provider "azurerm" {

怀疑环境注入的凭证干扰MSI认证，该如何排查？

1. 检查并清除冲突的环境变量 #

Terraform AzureRM provider会优先读取ARM_前缀的环境变量，即使配置了use_msi = true：

• 在构建代理上列出所有ARM_开头的环境变量：

  # Linux/macOS
  printenv | grep ARM_
  
  # Windows PowerShell
  Get-ChildItem Env: | Where-Object Name -like "ARM_*"
  

• 若存在ARM_CLIENT_SECRET、ARM_CLIENT_ID这类服务主体认证变量，直接清除后再运行Terraform：

  # Linux/macOS
  unset ARM_CLIENT_SECRET ARM_CLIENT_ID
  
  # Windows PowerShell
  Remove-Item Env:ARM_CLIENT_SECRET
  Remove-Item Env:ARM_CLIENT_ID
  

2. 强制忽略环境变量凭证 #

在provider配置中添加skip_environment_variables = true，强制只使用托管身份认证：

provider "azurerm" {
  features {}
  alias                      = "ss101"
  use_msi                    = true
  client_id                  = "3...5"
  subscription_id            = "6...2"
  skip_provider_registration = true
  skip_environment_variables = true # 新增该行
}

3. 验证托管身份有效性 #

在构建代理VM上用Azure CLI测试托管身份是否能正常获取令牌：

az login --identity --username "3...5" # 替换为你的托管身份client_id
az account show -s "6...2" # 验证是否能访问目标订阅

如果这一步报错，说明托管身份本身配置有问题（比如未分配订阅权限、VM上的MSI扩展异常），需先修复托管身份配置。

4. 检查模块内的provider配置 #

错误提示指向module.bootstrap内的provider，确认该模块是否存在独立的azurerm provider配置，是否覆盖了外部的MSI设置。确保模块的providers块正确关联外部带alias的provider，避免模块自行读取环境变量。

内容的提问来源于stack exchange，提问作者mark