如何用Terraform创建带X509证书的Azure IoT DPS注册组？寻替代Provider

1. 优先使用最新版AzureRM Provider #

AzureRM Provider早已支持DPS及X509注册组的创建，你大概率是使用了过时的Provider版本。请将azurerm Provider升级至3.0+，然后使用以下核心资源：

• azurerm_iot_dps：创建DPS实例
• azurerm_iot_dps_enrollment_group：定义X509类型的注册组
• azurerm_iot_dps_certificate：上传并验证X509根证书（按需）

示例代码：

resource "azurerm_resource_group" "dps_rg" {
  name     = "dps-resources"
  location = "East US"
}

resource "azurerm_iot_dps" "main" {
  name                = "my-dps-instance"
  resource_group_name = azurerm_resource_group.dps_rg.name
  location            = azurerm_resource_group.dps_rg.location

  sku {
    name     = "S1"
    capacity = 1
  }
}

resource "azurerm_iot_dps_certificate" "root_cert" {
  name                = "root-ca-cert"
  resource_group_name = azurerm_resource_group.dps_rg.name
  dps_name            = azurerm_iot_dps.main.name
  certificate_content = filebase64("./root-ca.pem")
}

resource "azurerm_iot_dps_enrollment_group" "x509_group" {
  name                = "x509-enroll-group"
  resource_group_name = azurerm_resource_group.dps_rg.name
  dps_name            = azurerm_iot_dps.main.name
  attestation_type    = "X509"

  x509_attestation {
    signing_certificate {
      name        = azurerm_iot_dps_certificate.root_cert.name
      thumbprint  = azurerm_iot_dps_certificate.root_cert.thumbprint
      certificate = azurerm_iot_dps_certificate.root_cert.certificate_content
      is_verified = true
    }
  }

  provisioning_state = "Enabled"
}

2. AzAPI Provider创建子资源（注册组） #

你之前使用AzAPI时仅创建了DPS实例，注册组是DPS的子资源，需单独定义。使用azapi_resource指定子资源类型Microsoft.Devices/provisioningServices/enrollmentGroups@2022-12-12，并关联到已创建的DPS：

示例代码：

resource "azapi_resource" "dps_x509_enroll_group" {
  type      = "Microsoft.Devices/provisioningServices/enrollmentGroups@2022-12-12"
  name      = "x509-enroll-group"
  parent_id = azurerm_iot_dps.main.id
  body = jsonencode({
    properties = {
      attestation = {
        type = "X509"
        x509 = {
          signingCertificates = {
            primary = {
              certificate = filebase64("./root-ca.pem")
              isVerified = true
            }
          }
        }
      }
      provisioningState = "Enabled"
      reprovisionPolicy = {
        updateHubAssignment = true
        migrateDeviceData = true
      }
    }
  })
}

3. 备选：通过Azure CLI直接调用 #

如果上述Provider仍有局限，可使用Terraform的local-exec或azurecli Provider执行Azure CLI命令创建注册组：

local-exec示例： #

resource "azurerm_iot_dps" "main" {
  # 已有的DPS配置
}

provisioner "local-exec" {
  command = "az iot dps enrollment-group create --dps-name ${azurerm_iot_dps.main.name} --resource-group ${azurerm_resource_group.dps_rg.name} --enrollment-id x509-enroll-group --attestation-type X509 --signing-cert ./root-ca.pem --verified"
}

Azure CLI Provider示例： #

provider "azurecli" {}

resource "azurecli_resource" "dps_enroll_group" {
  name          = "x509-enroll-group"
  resource_type = "Microsoft.Devices/provisioningServices/enrollmentGroups"
  parent_id     = azurerm_iot_dps.main.id
  parameters = jsonencode({
    properties = {
      attestation = {
        type = "X509"
        x509 = {
          signingCertificates = {
            primary = {
              certificate = filebase64("./root-ca.pem")
              isVerified = true
            }
          }
        }
      }
      provisioningState = "Enabled"
    }
  })
}

内容的提问来源于stack exchange，提问作者mickl