Terraform创建Azure专用链接范围服务时提示父资源不存在问题排查

问题场景 #

已通过Terraform成功创建Log Analytics工作区，但创建azurerm_monitor_private_link_scoped_service时出现404错误，提示父资源不存在。门户中可确认Log Analytics工作区已存在，错误信息如下：

│ Error: creating/updating Private Link Scoped Service: (Scoped Resource Name "scoped-log-sbx-we-oe728m" / Private Link Scope Name "log-sbx-we-oe728m" / Resource Group "hub"): insights.PrivateLinkScopedResourcesClient#CreateOrUpdate: Failure sending request: StatusCode=404 -- Original Error: Code="ParentResourceNotFound" Message="Can not perform requested operation on nested resource. Parent resource 'log-sbx-we-oe728m' not found."

原Terraform代码：

resource "azurerm_log_analytics_workspace" "logws" {
  name                = lower("log-${var.env}-${local.location_prefix[coalesce(var.location)]}-${random_string.postfix.result}")
  resource_group_name = azurerm_resource_group.rg[0].name
  location            = azurerm_resource_group.rg[0].location
  sku                 = var.log_analytics_workspace_sku
  retention_in_days   = var.log_analytics_logs_retention_in_days
  tags                = local.common_tags
}


resource "azurerm_monitor_private_link_scoped_service" "logscopelink" {
  name                = "scoped-${azurerm_log_analytics_workspace.logws.name}"
  resource_group_name = azurerm_resource_group.rg[0].name
  scope_name          = azurerm_log_analytics_workspace.logws.name
  linked_resource_id = azurerm_log_analytics_workspace.logws.id
  depends_on = [azurerm_log_analytics_workspace.logws]
}

问题原因 #

azurerm_monitor_private_link_scoped_service的scope_name参数指向的是**Azure Monitor Private Link Scope（AMPLS）**的名称，而非Log Analytics工作区的名称。原代码错误地将Log Analytics工作区名称填入该字段，导致Terraform无法找到对应的父资源（AMPLS），从而触发404错误。

解决方案 #

需要先创建Azure Monitor Private Link Scope资源，再将其名称作为scope_name传入azurerm_monitor_private_link_scoped_service，同时保持linked_resource_id指向Log Analytics工作区ID。

修正后的代码示例：

# 1. 创建Azure Monitor Private Link Scope
resource "azurerm_monitor_private_link_scope" "log_pls" {
  name                = "pls-${azurerm_log_analytics_workspace.logws.name}"
  resource_group_name = azurerm_resource_group.rg[0].name
  location            = azurerm_resource_group.rg[0].location
  tags                = local.common_tags
}

# 2. 创建Log Analytics工作区（保留原代码）
resource "azurerm_log_analytics_workspace" "logws" {
  name                = lower("log-${var.env}-${local.location_prefix[coalesce(var.location)]}-${random_string.postfix.result}")
  resource_group_name = azurerm_resource_group.rg[0].name
  location            = azurerm_resource_group.rg[0].location
  sku                 = var.log_analytics_workspace_sku
  retention_in_days   = var.log_analytics_logs_retention_in_days
  tags                = local.common_tags
}

# 3. 创建Private Link Scoped Service，关联AMPLS和Log Analytics工作区
resource "azurerm_monitor_private_link_scoped_service" "logscopelink" {
  name                = "scoped-${azurerm_log_analytics_workspace.logws.name}"
  resource_group_name = azurerm_resource_group.rg[0].name
  scope_name          = azurerm_monitor_private_link_scope.log_pls.name # 改为AMPLS的名称
  linked_resource_id  = azurerm_log_analytics_workspace.logws.id
  depends_on          = [azurerm_log_analytics_workspace.logws, azurerm_monitor_private_link_scope.log_pls]
}

说明 #

• Azure Monitor Private Link Scope是用于将Azure Monitor资源（如Log Analytics工作区、Application Insights实例）纳入私有链路访问的父资源，必须先创建该资源才能关联子资源。
• 修正后depends_on需包含AMPLS资源，确保其先于Scoped Service创建。

内容的提问来源于stack exchange，提问作者asp