如何通过Terraform配置Azure Logic App Management？

我正在为Azure中的一系列Logic App配置Logic App Management（当前处于预览模式），按照要求这类资源必须在Service Principal级别部署。我查阅了Terraform的AzureRM Provider、azurerm_logic_app_standard资源以及azurerm_log_analytics_workspace资源文档，均未找到明确的配置方法。请问有人使用Terraform实现过此配置吗？我希望坚持用IaC标准管理资源。

可行实现方案 #

由于Logic App Management处于预览阶段，AzureRM Provider暂时未提供专门的资源类型，不过可以通过以下两种方式用Terraform完成配置：

1. 使用AzAPI Provider调用预览版API #

AzAPI Provider专门用于支持Azure的预览资源和未被AzureRM覆盖的资源，可直接调用Logic App Management的REST API：

terraform {
  required_providers {
    azapi = {
      source  = "azure/azapi"
      version = ">=1.5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">=3.0.0"
    }
  }
}

provider "azurerm" {
  features {}
}

provider "azapi" {
  # 可复用AzureRM的认证配置，或单独配置
}

# 引用已存在的Log Analytics工作区
data "azurerm_log_analytics_workspace" "example" {
  name                = "existing-law"
  resource_group_name = "example-rg"
}

# 引用已存在的Standard Logic App
data "azurerm_logic_app_standard" "example" {
  name                = "existing-logic-app"
  resource_group_name = "example-rg"
}

# 配置Logic App Management
resource "azapi_resource" "logic_app_management" {
  type      = "Microsoft.Logic/workspaces/managementConfigurations@2023-01-01-preview"
  name      = "default" # 官方要求固定使用"default"作为名称
  parent_id = data.azurerm_logic_app_standard.example.id

  body = jsonencode({
    properties = {
      logAnalyticsConfiguration = {
        customerId = data.azurerm_log_analytics_workspace.example.workspace_id
        sharedKey  = data.azurerm_log_analytics_workspace.example.primary_shared_key
      }
    }
  })
}

2. 通过ARM模板部署（使用azurerm_resource_template_deployment） #

如果更熟悉ARM模板语法，可以编写对应模板后，用Terraform调用部署：

resource "azurerm_resource_template_deployment" "logic_app_management" {
  name                = "logic-app-management-deployment"
  resource_group_name = data.azurerm_logic_app_standard.example.resource_group_name

  template_content = jsonencode({
    "$schema" = "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#"
    contentVersion = "1.0.0.0"
    resources = [
      {
        type = "Microsoft.Logic/workspaces/managementConfigurations"
        apiVersion = "2023-01-01-preview"
        name = "${data.azurerm_logic_app_standard.example.name}/default"
        properties = {
          logAnalyticsConfiguration = {
            customerId = data.azurerm_log_analytics_workspace.example.workspace_id
            sharedKey  = data.azurerm_log_analytics_workspace.example.primary_shared_key
          }
        }
      }
    ]
  })
}

注意事项 #

• 确保用于部署的Service Principal拥有Microsoft.Logic/workspaces/managementConfigurations/write权限
• 预览版API版本可能会更新，需根据官方文档调整apiVersion值
• 共享密钥属于敏感数据，建议通过Azure Key Vault存储，再用azurerm_key_vault_secret引用，避免明文暴露

内容的提问来源于stack exchange，提问作者Basel Anani