执行Terraform Apply时Azure应用网关SSL证书引用失败

已通过Terraform创建应用网关、WAF策略及公网IP；通过Azure GUI创建Key Vault并上传PFX证书，同时创建托管身份并授予其Key Vault完全访问权限。尝试添加HTTPS监听器，通过data块调用Key Vault中存储的证书，但执行terraform apply时出现错误。所有资源（Key Vault、托管身份、应用网关、WAF策略）均位于同一区域。

错误信息 #

Error: updating Application Gateway: (Name "abc-xyz-Nonprod-test-us6-Extappgw0001" / Resource Group "xyz-network-vnet-devtest"): network.ApplicationGatewaysClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidResourceReference" Message="Resource /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xyz-network-vnet-devtest/providers/Microsoft.Network/applicationGateways/abc-xyz-Nonprod-test-us6-Extappgw0001/sslCertificates/firepfx referenced by resource /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xyz-network-vnet-devtest/providers/Microsoft.Network/applicationGateways/abc-xyz-Nonprod-test-us6-Extappgw0001/httpListeners/External_app_gtw_nonprod_backend_listener_https was not found. Please make sure that the referenced resource exists, and that both resources are in the same region." Details=[]

with azurerm_application_gateway.abc-xyz-Nonprod-test-us6-Extappgw0001,
on abc-xyz-Nonprod-test-us6-Extappgw0001.tf line 102, in resource "azurerm_application_gateway" "abc-xyz-Nonprod-test-us6-Extappgw0001":
102: resource "azurerm_application_gateway" "abc-xyz-Nonprod-test-us6-Extappgw0001"

当前代码仅在HTTPS监听器中引用了Key Vault证书的名称，但未在应用网关资源内定义ssl_certificate块。应用网关需要显式配置SSL证书关联，将Key Vault中的证书导入到应用网关的SSL证书资源中，监听器才能找到对应的证书资源。

在azurerm_application_gateway资源中添加ssl_certificate块，通过key_vault_secret_id引用Key Vault证书的Secret ID，同时确保托管身份拥有Key Vault的证书读取权限（已配置完全访问则满足要求）。

在应用网关资源中插入以下ssl_certificate块（位置可灵活调整，不影响功能）：

resource "azurerm_application_gateway" "abc-xyz-Nonprod-test-us6-Extappgw0001" {
  # 原有代码保持不变...

  # 新增SSL证书配置，关联Key Vault中的证书
  ssl_certificate {
    name               = "firepfx"
    key_vault_secret_id = data.azurerm_key_vault_certificate.firepfx.secret_id
  }

  identity {
    type         = "UserAssigned"
    identity_ids = [data.azurerm_user_assigned_identity.test-appgw-identity-us6.id]
  }

  # 原有代码保持不变...
}

关键修改说明 #

1. 添加的ssl_certificate块名称需与监听器中ssl_certificate_name一致（即firepfx）
2. 使用data.azurerm_key_vault_certificate.firepfx.secret_id作为key_vault_secret_id，应用网关会通过托管身份自动拉取该证书
3. 确认托管身份已拥有Key Vault的Certificate Get权限（已配置完全访问则此条件已满足）

内容的提问来源于stack exchange，提问作者Ghost rider