如何在Terraform中为不同模块配置不同版本的azurerm Provider？

我有一套包含嵌套模块的Terraform代码，结构如下：

根模块 main.tf #

module "FunctionApp" {
  source              = "../modules/FunctionApp"
  location            = var.location
  resourceGroupName   = module.rg.name
}

FunctionApp模块 main.tf #

resource "azurerm_resource_group" "example" {
  name     = "azure-functions-test-rg"
  location = "westus2"
}
resource "azurerm_storage_account" "example" {
  name                     = "functionsappsacostco"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  min_tls_version = "TLS1_2"
}

resource "azurerm_app_service_plan" "example" {
  name                = "azure-functions-test-service-plan"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  kind = "windows"
  sku {
    tier = "PremiumV2"
    size = "P1v2"
    }
}

resource "azurerm_function_app" "example" {
  name                       = "test-azure-functions-csco"
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key
  version = "~4"
}
module "fz_slot" {
source = "./fz-slot"
location = azurerm_resource_group.example.location
resource_group_name = azurerm_resource_group.example.name
app_service_plan_id = azurerm_app_service_plan.example.id
function_app_name = azurerm_function_app.example.name
storage_account_name = azurerm_storage_account.example.name
storage_account_access_key = azurerm_storage_account.example.primary_access_key
}

fz-slot模块 main.tf #

resource "azurerm_function_app_slot" "example" {
  provider                   = azurerm.old
  name                       = "staging"
  location                   = var.location
  resource_group_name        = var.resource_group_name
  app_service_plan_id        = var.app_service_plan_id
  function_app_name          = var.function_app_name
  storage_account_name       = var.storage_account_name
  storage_account_access_key = var.storage_account_access_key
  version = "~4"
}

需求：除fz-slot模块使用azurerm 2.67.0版本外，其余所有资源均使用最新版azurerm，该如何实现？

通过配置多实例Provider可以实现不同模块使用不同版本的AzureRM Provider，具体步骤如下：

1. 在根模块定义多版本Provider #

在根目录创建providers.tf（或直接写入main.tf），配置两个AzureRM Provider实例：一个默认用最新版，另一个命名为old锁定2.67.0版本。

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0.0" # 自动使用最新稳定版
    }
    azurerm-old = {
      source  = "hashicorp/azurerm"
      version = "2.67.0"
    }
  }
}

# 默认Provider实例，供根模块和FunctionApp模块使用
provider "azurerm" {
  features {}
}

# 旧版本Provider实例，命名为old，供fz-slot模块使用
provider "azurerm" {
  alias   = "old"
  features {}
}

2. 给fz-slot模块传递指定Provider #

修改FunctionApp模块中对fz-slot的引用，通过providers参数将azurerm.old传递给子模块，确保子模块使用指定版本的Provider。

更新FunctionApp模块main.tf中的模块引用部分：

module "fz_slot" {
  source = "./fz-slot"
  
  # 保留原有变量传递
  location                   = azurerm_resource_group.example.location
  resource_group_name        = azurerm_resource_group.example.name
  app_service_plan_id        = azurerm_app_service_plan.example.id
  function_app_name          = azurerm_function_app.example.name
  storage_account_name       = azurerm_storage_account.example.name
  storage_account_access_key = azurerm_storage_account.example.primary_access_key

  # 传递指定的旧版本Provider实例
  providers = {
    azurerm = azurerm.old
  }
}

3. 锁定fz-slot模块的Provider版本（可选） #

在fz-slot模块的providers.tf中明确声明版本约束，增强版本锁定的可靠性：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.67.0"
    }
  }
}

4. 初始化验证 #

执行terraform init，Terraform会同时下载最新版和2.67.0版本的AzureRM Provider。初始化完成后，根模块和FunctionApp模块的资源会使用默认的最新版Provider，fz-slot模块的资源则使用指定的2.67.0版本Provider。

内容的提问来源于stack exchange，提问作者Tony Jose