Terraform导入Azure自定义镜像VMSS遇osProfile为空错误

问题场景 #

通过自定义共享镜像在Azure门户创建的Linux虚拟机规模集（VMSS），Azure侧该VMSS不存在virtualMachineProfile.osProfile配置。使用以下Terraform导入命令时失败：

terraform import module.vm_scaleset.azurerm_linux_virtual_machine_scale_set.vmscaleset /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myrg/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1

报错信息：

Error: retrieving Virtual Machine Scale Set "vmss1" (Resource Group "myrg"): properties.virtualMachineProfile.osProfile was nil

关联的VMSS模块代码如下：

data "azurerm_lb" "loadbalancer" {
  name                = var.lbName
  resource_group_name = var.rgName
}

data "azurerm_lb_backend_address_pool" "addresspool" {
  loadbalancer_id = data.azurerm_lb.loadbalancer.id
  name            = var.lbAddressPool
}

data "azurerm_shared_image" "scaleset_image" {
  provider            = azurerm.ist
  name                = var.scaleset_image_name
  gallery_name        = var.scaleset_image_gallery
  resource_group_name = var.scaleset_image_rgname
}


resource "azurerm_linux_virtual_machine_scale_set" "vmscaleset" {
  name                            = var.vmssName
  resource_group_name             = var.rgName
  location                        = var.location
  sku                             = var.vms_sku
  instances                       = var.vm_instances
  admin_username                  = azurerm_key_vault_secret.vmssusername.value
  admin_password                  = azurerm_key_vault_secret.vmsspassword.value
  disable_password_authentication = false
  zones                           = var.vmss_zones
  source_image_id                 = data.azurerm_shared_image.scaleset_image.id
  tags                            = module.vmss_tags.tags

  os_disk {
    storage_account_type = var.vmss_osdisk_storage
    caching              = "ReadWrite"
    create_option        = "FromImage"
  }

  data_disk {
    storage_account_type = "StandardSSD_LRS"
    caching              = "None"
    disk_size_gb         = 1000
    lun                  = 10
    create_option        = "FromImage"
  }

  network_interface {
    name                          = format("nic-%s-001", var.vmssName)
    primary                       = true
    enable_accelerated_networking = true

    ip_configuration {
      name                                   = "internal"
      load_balancer_backend_address_pool_ids = [data.azurerm_lb_backend_address_pool.addresspool.id]
      primary                                = true
      subnet_id                              = var.subnet_id
    }
  }

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

可行解决方案 #

1. 配置Azurerm Provider跳过OS Profile验证 #

在Azurerm Provider配置块中添加特性开关，允许忽略VMSS的osProfile为空的情况：

provider "azurerm" {
  features {
    virtual_machine_scale_set {
      skip_os_profile_validation = true
    }
  }
}

添加该配置后重新执行导入命令，Provider会跳过osProfile的非空校验，直接完成导入。

2. 调整模块代码适配无osProfile的资源 #

由于目标VMSS本身没有osProfile，移除模块中属于osProfile范畴的字段，避免Terraform Schema校验冲突：

resource "azurerm_linux_virtual_machine_scale_set" "vmscaleset" {
  name                            = var.vmssName
  resource_group_name             = var.rgName
  location                        = var.location
  sku                             = var.vms_sku
  instances                       = var.vm_instances
  zones                           = var.vmss_zones
  source_image_id                 = data.azurerm_shared_image.scaleset_image.id
  tags                            = module.vmss_tags.tags

  os_disk {
    storage_account_type = var.vmss_osdisk_storage
    caching              = "ReadWrite"
    create_option        = "FromImage"
  }

  data_disk {
    storage_account_type = "StandardSSD_LRS"
    caching              = "None"
    disk_size_gb         = 1000
    lun                  = 10
    create_option        = "FromImage"
  }

  network_interface {
    name                          = format("nic-%s-001", var.vmssName)
    primary                       = true
    enable_accelerated_networking = true

    ip_configuration {
      name                                   = "internal"
      load_balancer_backend_address_pool_ids = [data.azurerm_lb_backend_address_pool.addresspool.id]
      primary                                = true
      subnet_id                              = var.subnet_id
    }
  }

  lifecycle {
    ignore_changes = [
      tags
    ]
  }
}

调整后配合方案1的Provider配置，重新执行导入即可成功。

3. 手动修正Terraform状态文件（兜底方案） #

如果上述方法无效，可通过手动修改状态文件绕过校验：

1. 执行terraform state pull > terraform.tfstate导出当前状态文件
2. 在状态文件中找到对应VMSS资源的配置，添加空的os_profile块：

   "os_profile": {}
   

3. 执行terraform state push terraform.tfstate推送修改后的状态
4. 在模块的lifecycle.ignore_changes中添加os_profile，避免后续Plan/Apply时触发变更：

   lifecycle {
     ignore_changes = [
       tags,
       os_profile
     ]
   }
   

验证导入结果 #

导入完成后执行terraform plan，确认输出中无不必要的资源变更提示，确保Terraform状态与Azure实际资源一致。

内容的提问来源于stack exchange，提问作者mags