跨资源组的Terraform Azure VNet Peering配置问题求助

我是Terraform新手，可能犯了基础错误。尝试配置分属不同资源组的Azure VNet对等连接，参考多个教程仍报错。后来发现把对等连接资源放在对应VNet的资源组中时，错误会少很多，希望能得到帮助。

我的配置代码如下：

# 创建资源组
resource "azurerm_resource_group" "network" {
  name     = "network"
  location = "West Europe"
}

resource "azurerm_resource_group" "front" {
  name     = "front"
  location = "West Europe"
}

resource "azurerm_resource_group" "middle" {
  name     = "middle"
  location = "West Europe"
}

resource "azurerm_resource_group" "back" {
  name     = "back"
  location = "West Europe"
}

resource "azurerm_resource_group" "peerings" {
  name     = "peerings"
  location = "West Europe"
}


# 创建虚拟网络
resource "azurerm_virtual_network" "network" {
  name                = "network"
  location            = azurerm_resource_group.network.location
  resource_group_name = azurerm_resource_group.network.name
  address_space       = ["10.1.0.0/16"]
  
  subnet {
    name           = "default"
    address_prefix = "10.1.0.0/24"
  }

  subnet {
    name           = "gatewaysubnet"
    address_prefix = "10.1.1.0/24"
  }

  subnet {
    name           = "azurefirewallsubnet"
    address_prefix = "10.1.3.0/24"
  }

  subnet {
    name           = "azurebastionsubnet"
    address_prefix = "10.1.2.0/24"
  }
}

resource "azurerm_virtual_network" "front" {
  name                = "network"
  location            = azurerm_resource_group.front.location
  resource_group_name = azurerm_resource_group.front.name
  address_space       = ["10.2.0.0/16"]
}

resource "azurerm_virtual_network" "middle" {
  name                = "network"
  location            = azurerm_resource_group.middle.location
  resource_group_name = azurerm_resource_group.middle.name
  address_space       = ["10.3.0.0/16"]
}

resource "azurerm_virtual_network" "back" {
  name                = "network"
  location            = azurerm_resource_group.back.location
  resource_group_name = azurerm_resource_group.back.name
  address_space       = ["10.4.0.0/16"]
}

# 创建对等连接
# network <--> front
resource "azurerm_virtual_network_peering" "networktofront" {
  name                      = "networktofront"
  resource_group_name       = azurerm_resource_group.peerings.name
  virtual_network_name      = azurerm_virtual_network.network.name
  remote_virtual_network_id = azurerm_virtual_network.front.id
}

resource "azurerm_virtual_network_peering" "fronttonetwork" {
  name                      = "fronttonetwork"
  resource_group_name       = azurerm_resource_group.peerings.name
  virtual_network_name      = azurerm_virtual_network.front.name
  remote_virtual_network_id = azurerm_virtual_network.network.id
}

# network <--> middle
resource "azurerm_virtual_network_peering" "networktomiddle" {
  name                      = "networktomiddle"
  resource_group_name       = azurerm_resource_group.peerings.name
  virtual_network_name      = azurerm_virtual_network.network.name
  remote_virtual_network_id = azurerm_virtual_network.middle.id
}

resource "azurerm_virtual_network_peering" "middletonetwork" {
  name                      = "middletonetwork"
  resource_group_name       = azurerm_resource_group.peerings.name
  virtual_network_name      = azurerm_virtual_network.middle.name
  remote_virtual_network_id = azurerm_virtual_network.network.id
}

# network <--> back
resource "azurerm_virtual_network_peering" "networktoback" {
  name                      = "networktoback"
  resource_group_name       = azurerm_resource_group.peerings.name
  virtual_network_name      = azurerm_virtual_network.network.name
  remote_virtual_network_id = azurerm_virtual_network.back.id
}

resource "azurerm_virtual_network_peering" "backtonetwork" {
  name                      = "backtonetwork"
  resource_group_name       = azurerm_resource_group.peerings.name
  virtual_network_name      = azurerm_virtual_network.back.name
  remote_virtual_network_id = azurerm_virtual_network.network.id
}

问题分析与修正方案 #

核心错误点

Azure的VNet对等连接资源必须与发起连接的VNet处于同一资源组，不能放在独立的peerings资源组中。这是因为对等连接是依附于VNet的子资源，其生命周期与所属VNet绑定。

修正后的对等连接配置

将每个对等连接的resource_group_name修改为对应VNet所在的资源组，示例如下：

# network <--> front
resource "azurerm_virtual_network_peering" "networktofront" {
  name                      = "networktofront"
  # 改为network VNet所在的资源组
  resource_group_name       = azurerm_resource_group.network.name
  virtual_network_name      = azurerm_virtual_network.network.name
  remote_virtual_network_id = azurerm_virtual_network.front.id
  # 显式设置允许VNet访问（默认true，建议显式声明）
  allow_virtual_network_access = true
}

resource "azurerm_virtual_network_peering" "fronttonetwork" {
  name                      = "fronttonetwork"
  # 改为front VNet所在的资源组
  resource_group_name       = azurerm_resource_group.front.name
  virtual_network_name      = azurerm_virtual_network.front.name
  remote_virtual_network_id = azurerm_virtual_network.network.id
  allow_virtual_network_access = true
}

# network <--> middle
resource "azurerm_virtual_network_peering" "networktomiddle" {
  name                      = "networktomiddle"
  resource_group_name       = azurerm_resource_group.network.name
  virtual_network_name      = azurerm_virtual_network.network.name
  remote_virtual_network_id = azurerm_virtual_network.middle.id
  allow_virtual_network_access = true
}

resource "azurerm_virtual_network_peering" "middletonetwork" {
  name                      = "middletonetwork"
  resource_group_name       = azurerm_resource_group.middle.name
  virtual_network_name      = azurerm_virtual_network.middle.name
  remote_virtual_network_id = azurerm_virtual_network.network.id
  allow_virtual_network_access = true
}

# network <--> back
resource "azurerm_virtual_network_peering" "networktoback" {
  name                      = "networktoback"
  resource_group_name       = azurerm_resource_group.network.name
  virtual_network_name      = azurerm_virtual_network.network.name
  remote_virtual_network_id = azurerm_virtual_network.back.id
  allow_virtual_network_access = true
}

resource "azurerm_virtual_network_peering" "backtonetwork" {
  name                      = "backtonetwork"
  resource_group_name       = azurerm_resource_group.back.name
  virtual_network_name      = azurerm_virtual_network.back.name
  remote_virtual_network_id = azurerm_virtual_network.network.id
  allow_virtual_network_access = true
}

额外优化建议

• 虽然不同资源组的VNet可以同名，但为了可读性，建议给每个VNet设置独特的名称（比如vnet-network、vnet-front），避免混淆。
• 可以删除单独的peerings资源组，因为对等连接不再需要它。

内容的提问来源于stack exchange，提问作者Nico