Terraform部署Azure带WAF的应用网关时Provider查询失败求助

尝试通过Terraform在Azure部署包含WAF_v2版本Application Gateway和两台后端虚拟机的基础设施。原本部署不带WAF的Standard_v2版本Application Gateway正常，但添加WAF后执行terraform init时出现Provider查询失败错误：

Error: Failed to query available provider packages
│
│ Could not retrieve the list of available versions for provider hashicorp/example: provider registry registry.terraform.io does not have a provider named
│ registry.terraform.io/hashicorp/example
│
│ All modules should specify their required_providers so that external consumers will get the correct providers when using a module. To see which modules are currently depending
│ on hashicorp/example, run the following command:
│     terraform providers

执行terraform providers后确认配置依赖hashicorp/example Provider，需要修复该错误以完成带WAF的基础设施部署。

这个错误是因为Terraform配置文件中意外引入了不存在的hashicorp/example Provider，大概率是复制代码时的残留片段、笔误，或是子模块配置错误导致。Azure相关资源的Terraform Provider应为hashicorp/azurerm，而非hashicorp/example。

1. 定位并移除错误的Provider引用 #

遍历所有.tf配置文件（包括根模块和子模块），查找所有包含hashicorp/example的代码段：

• 检查required_providers块，确保只声明azurerm Provider
• 检查资源或数据源的provider参数，确保没有指定example Provider

2. 确保正确配置Azure Provider #

在根模块的providers.tf（或main.tf）中添加正确的Provider配置：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0.0" # 使用兼容WAF_v2的版本
    }
  }
}

provider "azurerm" {
  features {}
}

3. 修正Application Gateway WAF_v2配置 #

确保Application Gateway的WAF配置符合Azure Provider的语法要求，示例代码如下：

resource "azurerm_application_gateway" "example" {
  name                = "example-appgw"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  sku {
    name     = "WAF_v2"
    tier     = "WAF_v2"
    capacity = 2
  }

  # WAF核心配置
  waf_configuration {
    enabled          = true
    firewall_mode    = "Detection" # 可选Prevention模式（直接拦截违规请求）
    rule_set_type    = "OWASP"
    rule_set_version = "3.2"

    # 自定义IP允许规则（替换为你的实际信任IP）
    custom_rules {
      name      = "AllowTrustedIP"
      priority  = 100
      rule_type = "MatchRule"

      match_conditions {
        match_variables {
          variable_name = "RemoteAddr"
        }

        operator           = "IPMatch"
        match_values       = ["XX.XX.XX.XX"] # 你的信任IP地址
        negation_condition = false
      }

      action = "Allow"
    }
  }

  # 后端池配置（关联两台虚拟机）
  backend_address_pool {
    name = "backend-pool"

    ip_addresses = [azurerm_linux_virtual_machine.vm1.private_ip_address, azurerm_linux_virtual_machine.vm2.private_ip_address]
  }

  # 以下为必要的配套配置（需根据实际需求补充完整）
  backend_http_settings {
    name                  = "backend-http-settings"
    cookie_based_affinity = "Disabled"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 60
  }

  http_listener {
    name                           = "http-listener"
    frontend_ip_configuration_name = "frontend-ip"
    frontend_port_name             = "frontend-port"
    protocol                       = "Http"
  }

  request_routing_rule {
    name                       = "request-routing-rule"
    rule_type                  = "Basic"
    http_listener_name         = azurerm_application_gateway.example.http_listener[0].name
    backend_address_pool_name  = azurerm_application_gateway.example.backend_address_pool[0].name
    backend_http_settings_name = azurerm_application_gateway.example.backend_http_settings[0].name
  }

  # 省略前端IP、前端端口等基础配置
}

4. 重新初始化Terraform #

执行以下命令完成初始化：

terraform init

5. 验证配置并部署 #

执行terraform plan检查配置是否正确，确认无误后执行terraform apply完成部署。

• 确保使用的azurerm Provider版本支持WAF_v2（建议3.0.0及以上）
• WAF的firewall_mode可根据需求选择Detection（仅记录违规请求）或Prevention（直接拦截）
• 自定义规则的priority值需唯一，数值越小优先级越高

内容的提问来源于stack exchange，提问作者Gregory