Terraform v3.11中无法为NAT Gateway关联Public IP问题求助

问题场景 #

按照Terraform AzureRM官方文档（v3.11）配置NAT Gateway时，尝试通过public_ip_address_ids参数关联公网IP ID失败，配置代码如下：

resource "azurerm_nat_gateway" "nat_gateway" {
    name                    = var.nat_gateway_name
    location                = "northeurope"
    resource_group_name     = var.resource_group_name
    public_ip_address_ids   = [azurerm_public_ip.pip.id]
    sku_name                = "Standard"
    idle_timeout_in_minutes = 10
    zones                   = ["1"] 
}

尝试过硬编码IP ID、使用空变量等方式，均未解决问题，报错信息：

│ Error: Unsupported argument
│ 
│   on ../modules/function-app-module/main.tf line 40, in resource "azurerm_nat_gateway" "nat_gateway":
│   40:   public_ip_address_ids   = [azurerm_public_ip.pip.id]
│ 
│ An argument named "public_ip_address_ids" is not expected here.

原因分析 #

Terraform AzureRM Provider从v3.0版本开始重构了NAT Gateway的资源结构，原public_ip_address_ids参数被移除，改为通过内嵌关联块或独立关联资源实现公网IP绑定。

解决方法 #

方法1：使用内嵌public_ip_association块 #

直接在NAT Gateway资源中添加内嵌块关联公网IP：

resource "azurerm_nat_gateway" "nat_gateway" {
    name                    = var.nat_gateway_name
    location                = "northeurope"
    resource_group_name     = var.resource_group_name
    sku_name                = "Standard"
    idle_timeout_in_minutes = 10
    zones                   = ["1"] 

    # 替换原public_ip_address_ids参数
    public_ip_association {
        public_ip_address_id = azurerm_public_ip.pip.id
    }
}

若需关联多个公网IP，添加多个public_ip_association块即可：

resource "azurerm_nat_gateway" "nat_gateway" {
    # 基础配置不变...

    public_ip_association {
        public_ip_address_id = azurerm_public_ip.pip1.id
    }

    public_ip_association {
        public_ip_address_id = azurerm_public_ip.pip2.id
    }
}

方法2：使用独立关联资源 #

创建单独的azurerm_nat_gateway_public_ip_association资源管理绑定关系，适合动态调整关联的场景：

# 定义NAT Gateway主资源
resource "azurerm_nat_gateway" "nat_gateway" {
    name                    = var.nat_gateway_name
    location                = "northeurope"
    resource_group_name     = var.resource_group_name
    sku_name                = "Standard"
    idle_timeout_in_minutes = 10
    zones                   = ["1"] 
}

# 关联公网IP到NAT Gateway
resource "azurerm_nat_gateway_public_ip_association" "pip_bind" {
    nat_gateway_id       = azurerm_nat_gateway.nat_gateway.id
    public_ip_address_id = azurerm_public_ip.pip.id
}

内容的提问来源于stack exchange，提问作者gjgjgjgj14