使用Terraform创建Azure VPN网关时遇重复块错误求助

错误原因 #

你用dynamic "vpn_client_configuration"遍历了整个var.audience映射（包含dev/stg/prod三个键值对），导致Terraform生成了3个vpn_client_configuration块，但Azure的azurerm_virtual_network_gateway资源仅允许最多1个该配置块，因此触发报错。

修正方案 #

不需要用dynamic块遍历所有环境，直接通过var.env参数作为键，从var.audience中取出对应环境的audience值，只保留一个vpn_client_configuration块即可：

修改后的完整资源配置

resource "azurerm_virtual_network_gateway" "vpn-gw" {
  name                = "vng-orpcb-hub-${var.env}-we"
  location            = azurerm_resource_group.rg[0].location
  resource_group_name = azurerm_resource_group.rg[0].name
  type                = "Vpn"
  vpn_type            = "RouteBased"
  active_active       = true
  enable_bgp          = false
  sku                 = "VpnGw1AZ"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn-gateway-ip.id    
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = data.azurerm_subnet.gatewaysubnetdata.id
  }

  ip_configuration {
    name                          = "vnetGatewayConfig1"
    public_ip_address_id          = azurerm_public_ip.vpn-gateway-ip-secondary.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = data.azurerm_subnet.gatewaysubnetdata.id
  }

  ip_configuration {
    name                          = "vnetGatewayConfig2"
    public_ip_address_id          = azurerm_public_ip.vpn-gateway-ip-vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = data.azurerm_subnet.gatewaysubnetdata.id
  }

  # 根据当前环境参数匹配对应audience值，仅生成一个客户端配置块
  vpn_client_configuration {
    address_space     = ["10.100.0.0/24"]
    vpn_auth_types    = ["AAD"]
    aad_tenant        = "https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    aad_audience      = var.audience[var.env]
    aad_issuer        = "https://sts.windows.net/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/"
  }
}

补充配置 #

确保你已定义var.env变量（添加到variable.tf中），并限制其可选值避免错误：

variable "env" {
  description = "部署目标环境（dev/stg/prod）"
  type        = string
  validation {
    condition     = contains(keys(var.audience), var.env)
    error_message = "env参数必须为dev、stg或prod中的一个。"
  }
}

使用方式 #

执行Terraform时，通过命令行参数或tfvars文件指定环境：

• 命令行：terraform apply -var="env=dev"
• tfvars文件：在terraform.tfvars中添加env = "stg"

这样既满足了根据环境匹配audience的需求，又不会生成多个不被允许的配置块。

内容的提问来源于stack exchange，提问作者asp