如何在Terraform中将多个子网ID传入Key Vault模块？

1. 给Subnet模块添加输出配置 #

在./modules/subnet目录下创建outputs.tf，用于输出每个子网的ID：

output "subnet_id" {
  type        = string
  description = "当前子网的ID"
  value       = azurerm_subnet.subnet.id
}

2. 修正Main.tf中的子网ID收集逻辑 #

由于module.subnet是通过for_each创建的实例集合，需要用values()函数提取所有实例的subnet_id并转换为列表，同时修复重复赋值的问题：

module "key_vault" {
 source = "./../resource_modules/key_vault"
            
# init
tenant_id = var.tfvars.tenant_id
            
# rg
key_vault_rg_name = var.region.key_vault_rg_name
location          = var.region.location
            
# key vault
key_vault        = var.tfvars.key_vault # 移除重复的key_vault赋值
spn_object_id    = var.tfvars.spn_object_id
            
# 收集所有子网ID为列表传入Key Vault
virtual_network_subnet_ids = values(module.subnet)[*].subnet_id
}

3. 确保Key Vault模块支持列表类型的子网ID变量 #

在./../resource_modules/key_vault的variables.tf中，定义virtual_network_subnet_ids为列表类型：

variable "virtual_network_subnet_ids" {
  type        = list(string)
  description = "允许访问Key Vault的子网ID列表"
}

4. 修正Subnet模块的变量引用错误 #

Subnet.tf中使用的var.netrg_name与Main.tf传入的network_rg变量名不匹配，统一为：

resource "azurerm_subnet" "subnet" {
  resource_group_name  = var.network_rg 
  name                 = var.region.name
  address_prefixes     = var.region.address_prefixes
  virtual_network_name = var.vnet_name

  enforce_private_link_endpoint_network_policies = var.region.enforce_private_link_endpoint_network_policies
}

5. 补全子网变量定义（语法+内容） #

修正Variables.tf中的语法错误，并补全剩余2个子网的定义：

# Subnets
subnet = {
  "subnet1" = {
    name = "subnet1"
    address_prefixes = ["10.0.1.0/24"] # 替换为实际地址段
    route_table_name = ""
    enforce_private_link_endpoint_network_policies = true # 根据需求设置
  },
  "subnet2" = {
    name = "subnet2"
    address_prefixes = ["10.0.2.0/24"]
    route_table_name = ""
    enforce_private_link_endpoint_network_policies = true
  },
  "subnet3" = {
    name = "subnet3"
    address_prefixes = ["10.0.3.0/24"]
    route_table_name = ""
    enforce_private_link_endpoint_network_policies = true
  },
  "subnet4" = {
    name = "subnet4"
    address_prefixes = ["10.0.4.0/24"]
    route_table_name = ""
    enforce_private_link_endpoint_network_policies = true
  },
  "subnet5" = {
    name = "subnet5"
    address_prefixes = ["10.0.5.0/24"]
    route_table_name = ""
    enforce_private_link_endpoint_network_policies = true
  }
}

内容的提问来源于stack exchange，提问作者Tyra