Azure Terraform使用azurerm_virtual_machine_extension执行多行PowerShell脚本遇阻

问题背景 #

在Azure环境中通过Terraform部署VM时，使用azurerm_virtual_machine_extension的CustomScriptExtension执行单段PowerShell命令（如安装Windows Server角色）可正常运行，但合并多行命令（安装角色+初始化RAW SSD磁盘）时出现异常。需求是必须使用内联代码，不通过存储账户上传脚本。

问题代码分析 #

原代码重复调用powershell -ExecutionPolicy Unrestricted，导致命令在多个PowerShell会话中执行，可能引发上下文异常：

resource "azurerm_virtual_machine_extension" "vmext" {
  name                 = "vmext"
  virtual_machine_id   = azurerm_windows_virtual_machine.app_vm.id
  publisher            = "Microsoft.Compute"
  type                 = "CustomScriptExtension"
  type_handler_version = "1.10"

  settings = <<SETTINGS
    {
      "commandToExecute": "powershell -ExecutionPolicy Unrestricted Install-windowsfeature -name RoleName -IncludeManagementTools; powershell -ExecutionPolicy Unrestricted Get-Disk | Where-Object -FilterScript {$_.PartitionStyle -eq 'RAW'} | Initialize-Disk -PartitionStyle MBR -PassThru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel 'disk2' -Confirm:$false"     
    }
SETTINGS
}

修正方案 #

核心优化点 #

• 仅启动一次PowerShell进程，用-Command参数包裹所有命令，确保在同一个会话中执行
• 对JSON字符串内的双引号进行转义（\"），避免语法解析错误
• 移除重复的powershell调用，减少不必要的进程开销

修正后代码 #

resource "azurerm_virtual_machine_extension" "vmext" {
  name                 = "vmext"
  virtual_machine_id   = azurerm_windows_virtual_machine.app_vm.id
  publisher            = "Microsoft.Compute"
  type                 = "CustomScriptExtension"
  type_handler_version = "1.10"

  settings = <<SETTINGS
    {
      "commandToExecute": "powershell -ExecutionPolicy Unrestricted -Command \"Install-WindowsFeature -Name RoleName -IncludeManagementTools; Get-Disk | Where-Object {$_.PartitionStyle -eq 'RAW'} | Initialize-Disk -PartitionStyle MBR -PassThru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel 'disk2' -Confirm:$false\""
    }
SETTINGS
}

可读性优化版本（多行命令） #

若需要让内联命令结构更清晰，可在JSON字符串中用\n插入换行：

resource "azurerm_virtual_machine_extension" "vmext" {
  name                 = "vmext"
  virtual_machine_id   = azurerm_windows_virtual_machine.app_vm.id
  publisher            = "Microsoft.Compute"
  type                 = "CustomScriptExtension"
  type_handler_version = "1.10"

  settings = <<SETTINGS
    {
      "commandToExecute": "powershell -ExecutionPolicy Unrestricted -Command \"Install-WindowsFeature -Name RoleName -IncludeManagementTools; `nGet-Disk | Where-Object {$_.PartitionStyle -eq 'RAW'} | Initialize-Disk -PartitionStyle MBR -PassThru | New-Partition -AssignDriveLetter -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel 'disk2' -Confirm:$false\""
    }
SETTINGS
}

补充说明 #

• 需将代码中的RoleName替换为实际需要安装的Windows Server角色名称（如Web-Server）
• CustomScriptExtension默认以系统管理员权限运行，无需额外配置权限
• 可通过Azure Portal查看VM扩展的执行日志，排查命令执行失败的具体原因

内容的提问来源于stack exchange，提问作者tester81