Azure Key Vault密钥跨订阅迁移Terraform代码报错求助

问题原因 #

目标订阅的azurerm_key_vault_secret资源中，value字段被赋值为一个列表，但该字段要求单个字符串值；同时你错误引用了secret的name而非实际的value属性，双重原因导致类型不匹配报错。

修正后的代码 #

data "azurerm_key_vault" "ewo1" {
  provider            = azurerm.demo-eworx-terraform-automation
  name                = "demo-eworx-keyvault"
  resource_group_name = "demo-eworx-rg"
}

output "vault_uri_ewo1" {
  value = data.azurerm_key_vault.ewo1.vault_uri
}

data "azurerm_key_vault_secret" "ewo1" {
  provider     = azurerm.demo-eworx-terraform-automation
  for_each = toset(["demo-eworx-terraform-automation-client-secret", "demo-eworx-terraform-automation-client-id", "demo-eworx-terraform-automation-tenant-id", "demo-eworx-terraform-automation-subscription-id"])
  name         = each.key
  key_vault_id = data.azurerm_key_vault.ewo1.id
}

output "secret_value" {
  value     = { for k, v in data.azurerm_key_vault_secret.ewo1 : k => v.value }
}

data "azurerm_key_vault" "ewo11" {
  provider = azurerm.terraform-automation
  name                = "demo-bteb-keyvault"
  resource_group_name = "bteb-demo-work"
}

output "vault_uri_ewo11" {
  value = data.azurerm_key_vault.ewo11.vault_uri
}

resource "azurerm_key_vault_secret" "ewo11" {
  provider = azurerm.terraform-automation
  for_each = toset(["demo-eworx-terraform-automation-client-secret", "demo-eworx-terraform-automation-client-id", "demo-eworx-terraform-automation-tenant-id", "demo-eworx-terraform-automation-subscription-id"])
  name         = each.key
  value        = data.azurerm_key_vault_secret.ewo1[each.key].value
  key_vault_id = data.azurerm_key_vault.ewo11.id
}

关键修正说明 #

1. 目标资源value字段修正：通过each.key直接匹配源订阅中同名secret的value属性，确保每个目标secret对应源中真实的密钥值，且类型为字符串，满足字段要求。
2. 输出优化：将secret_value输出改为键值对格式，更直观展示每个secret的名称与对应值，便于验证源数据是否正确获取。

内容的提问来源于stack exchange，提问作者Mohan Kumar G