Terraform Azure私有端点模块自动化配置需求求助

针对你提出的三个自动化需求，以下是具体实现方案，通过调整模块变量、添加本地值处理逻辑完成自动识别和命名：

核心实现思路 #

1. 自动识别subresource_name：解析目标资源ID提取资源类型，通过预设映射表匹配对应的subresource_name
2. 自动生成命名：从资源ID中提取资源名称，结合小写的subresource_name按指定格式拼接端点和连接名称
3. 简化变量输入：用户仅需传入目标资源ID和子网ID，其余字段自动生成

修改后的完整模块代码 #

1. 变量定义（variables.tf） #

variable "endpoints" {
  type = list(object({
    private_connection_resource_id = string
    subnet_id                     = string
    # 可选字段：当自动识别不符合需求时，手动覆盖subresource_name
    override_subresource_name = optional(string)
  }))
  description = "待创建的私有端点列表，仅需传入目标资源ID和子网ID"
}

variable "location" {
  type        = string
  description = "私有端点部署的区域"
}

variable "resource_group_name" {
  type        = string
  description = "私有端点所属的资源组名称"
}

variable "tags" {
  type        = map(string)
  description = "私有端点的标签"
  default     = {}
}

2. 本地值处理逻辑（locals.tf） #

locals {
  # 资源类型与subresource_name的映射表，可根据业务需要扩展
  resource_type_subresource_map = {
    "Microsoft.Storage/storageAccounts"      = "blob"
    "Microsoft.DBforMySQL/servers"           = "mysqlServer"
    "Microsoft.DBforMariaDB/servers"         = "mariadbServer"
    "Microsoft.Sql/servers"                  = "sqlServer"
    "Microsoft.KeyVault/vaults"              = "vault"
    "Microsoft.CognitiveServices/accounts"   = "account"
  }

  # 预处理每个端点，生成自动字段
  processed_endpoints = {
    for idx, endpoint in var.endpoints :
    idx => {
      # 从资源ID中提取资源类型和资源名称
      resource_type   = split("/", endpoint.private_connection_resource_id)[6]
      resource_name   = split("/", endpoint.private_connection_resource_id)[8]
      
      # 优先使用手动覆盖值，否则从映射表中匹配
      subresource_name = lookup(endpoint, "override_subresource_name", 
        lookup(local.resource_type_subresource_map, split("/", endpoint.private_connection_resource_id)[6], ""))
      
      # 生成私有端点名称：pendp-小写subresource-资源名
      endpoint_name   = "pendp-${lower(each.value.subresource_name)}-${each.value.resource_name}"
      # 生成私有连接名称：connection-小写subresource-资源名
      connection_name = "connection-${lower(each.value.subresource_name)}-${each.value.resource_name}"
      
      # 保留原始必填字段
      subnet_id                     = endpoint.subnet_id
      private_connection_resource_id = endpoint.private_connection_resource_id
    }
  }
}

3. 私有端点资源定义（main.tf） #

terraform {
  required_version        = "~> 1"
  required_providers {
    azurerm               = "~> 3.0"
  }
}

resource "azurerm_private_endpoint" "endpoint" {
  for_each            = local.processed_endpoints
  name                = each.value.endpoint_name
  location            = var.location
  resource_group_name = var.resource_group_name
  subnet_id           = each.value.subnet_id

  private_service_connection {
    name                           = each.value.connection_name
    private_connection_resource_id = each.value.private_connection_resource_id
    is_manual_connection           = false
    subresource_names              = [each.value.subresource_name]
  }

  lifecycle {
    ignore_changes = [
      private_dns_zone_group
    ]
  }
  tags = var.tags
}

使用示例 #

module "private_endpoints" {
  source = "./modules/private-endpoints"

  location            = "eastus"
  resource_group_name = "prod-rg"
  tags = {
    Environment = "Production"
    Owner       = "DevOps"
  }

  endpoints = [
    {
      private_connection_resource_id = "/subscriptions/xxxx-xxxx-xxxx-xxxx/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/prodstorage"
      subnet_id                     = "/subscriptions/xxxx-xxxx-xxxx-xxxx/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prodvnet/subnets/private-subnet"
    },
    {
      private_connection_resource_id = "/subscriptions/xxxx-xxxx-xxxx-xxxx/resourceGroups/prod-rg/providers/Microsoft.DBforMySQL/servers/prodmysql"
      subnet_id                     = "/subscriptions/xxxx-xxxx-xxxx-xxxx/resourceGroups/prod-rg/providers/Microsoft.Network/virtualNetworks/prodvnet/subnets/private-subnet"
    }
  ]
}

关键说明 #

• 资源ID解析逻辑：Azure标准资源ID格式为/subscriptions/{subId}/resourceGroups/{rgName}/providers/{resourceType}/{resourceName}，因此通过split函数提取索引6（资源类型）和索引8（资源名称）
• 映射表扩展：如果需要支持更多资源类型，直接在resource_type_subresource_map中添加键值对即可
• 手动覆盖机制：当自动识别的subresource_name不符合需求时，可通过override_subresource_name字段手动指定

内容的提问来源于stack exchange，提问作者ZAROUAL Aziz