使用Pulumi创建Azure应用网关时遇InvalidResourceReference错误

执行pulumi run时触发以下错误：

error: Code="InvalidResourceReference" Message="Resource /subscriptions//resourceGroups/RG-WAF-GX/providers/Microsoft.Network/applicationGateways/APPGW-TEST7581 referenced by resource /subscriptions//resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/application_gateway_waf82529b3f was not found. Please make sure that the referenced resource exists, and that both resources are in the same region." Details=[{"code":"NotFound","message":"Resource /subscriptions//resourceGroups/RG-WAF**-GX/providers/Microsoft.Network/applicationGateways/APPGW-TEST7581 not found."}]

我尝试用Pulumi创建Azure应用网关，代码中为backend_pool等组件关联了待创建网关的ID，但出现上述资源不存在的报错。我的代码如下：

application_gateway_waf = network.ApplicationGateway("application_gateway_waf",                                                                                                                                                                                                         
                                                      location="eastus",                                                                                                                                                                                                                 
                                                      sku=network.ApplicationGatewaySkuArgs(                                                                                                                                                                                              
                                                          capacity=2,                                                                                                                                                                                                                     
                                                          name="Standard_v2",                                                                                                                                                                                                             
                                                          tier="Standard_v2",                                                                                                                                                                                                             
                                                      ),                                                                                                                                                                                                                                  
                                                      resource_group_name='rg-waf-gx',                                                                                                                                                                                                 
                                                      gateway_ip_configurations=[network.ApplicationGatewayIPConfigurationArgs(                                                                                                                                                           
                                                          name="appwg_ip_config",                                                                                                                                                                                                         
                                                          subnet=network.SubResourceArgs(                                                                                                                                                                                                 
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/virtualNetworks/test-waf-vnet7581/subnets/appgw-subnet",                                                    
                                                          ),                                                                                                                                                                                                                              
                                                      )],                                                                                                                                                                                                                                 
                                                      frontend_ip_configurations=[network.ApplicationGatewayFrontendIPConfigurationArgs(                                                                                                                                                 
                                                          name="appgw_front_ip_config",                                                                                                                                                                                                   
                                                          public_ip_address=network.SubResourceArgs(                                                                                                                                                                                      
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/publicIPAddresses/pip-appgw-waf7581",                                                                       
                                                          ),                                                                                                                                                                                                                              
                                                      )],                                                                                                                                                                                                                                 
                                                      frontend_ports=[network.ApplicationGatewayFrontendPortArgs(                                                                                                                                                                         
                                                          name="appgw_front_port",                                                                                                                                                                                                        
                                                          port=80,                                                                                                                                                                                                                        
                                                      )],                                                                                                                                                                                                                                 
                                                      backend_address_pools=[network.ApplicationGatewayBackendAddressPoolArgs(                                                                                                                                                            
                                                          backend_addresses=[network.ApplicationGatewayBackendAddressArgs(                                                                                                                                                                
                                                              fqdn = "web-app-waf7581.azurewebsites.net",                                                                                                                                                                                 
                                                          )],                                                                                                                                                                                                                             
                                                          name="backend_portal",                                                                                                                                                                                                         
                                                      )],                                                                                                                                                                                                                                 
                                                      backend_http_settings_collection=[network.ApplicationGatewayBackendHttpSettingsArgs(                                                                                                                                               
                                                          name="backend_portal_http_setting",                                                                                                                                                                                             
                                                          protocol="http",                                                                                                                                                                                                               
                                                          port=80,                                                                                                                                                                                                                        
                                                          cookie_based_affinity="Disabled",                                                                                                                                                                                               
                                                          request_timeout=20,                                                                                                                                                                                                             
                                                          pick_host_name_from_backend_address=True,                                                                                                                                                                                       
                                                          probe=network.SubResourceArgs(                                                                                                                                                                                                 
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/probes/probe_portal_backend_setting4848488484"                           
                                                          ),                                                                                                                                                                                                                              
                                                      )],                                                                                                                                                                                                                                 
                                                      http_listeners=[network.ApplicationGatewayHttpListenerArgs(                                                                                                                                                                         
                                                          name="listener_portal",                                                                                                                                                                                                         
                                                          frontend_ip_configuration=network.SubResourceArgs(                                                                                                                                                                              
                                                              id= "/subscriptions/****/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/frontendIPConfigurations/appgw_front_ip_config",                        
                                                          ),                                                                                                                                                                                                                              
                                                          frontend_port=network.SubResourceArgs(                                                                                                                                                                                          
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/frontendPorts/appgw_front_port",                                         
                                                          ),                                                                                                                                                                                                                              
                                                          protocol="http",                                                                                                                                                                                                               
                                                          ssl_certificate= None,                                                                                                                                                                                                         
                                                          host_name="portal1.mohsenakhavan.com",                                                                                                                                                                                          
                                                          require_server_name_indication= False,                                                                                                                                                                                          
                                                      )],                                                                                                                                                                                                                                 
                                                      request_routing_rules=[network.ApplicationGatewayRequestRoutingRuleArgs(                                                                                                                                                            
                                                          name="rule_portal",                                                                                                                                                                                                             
                                                          backend_address_pool=network.SubResourceArgs(                                                                                                                                                                                   
                                                              id="/subscriptions/****/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/backendAddressPools/backend_portal",                                     
                                                          ),                                                                                                                                                                                                                              
                                                          http_listener=network.SubResourceArgs(                                                                                                                                                                                          
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/httpListeners/linstener",                                                
                                                          ),                                                                                                                                                                                                                              
                                                          backend_http_settings=network.SubResourceArgs(                                                                                                                                                                                  
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/backendHttpSettingsCollection/backend_portal_http_setting",              
                                                          ),                                                                                                                                                                                                                              
                                                          priority=100,                                                                                                                                                                                                                   
                                                      )],                                                                                                                                                                                                                                 
                                                      enable_http2=False,                                                                                                                                                                                                                 
                                                      probes=[network.ApplicationGatewayProbeArgs(                                                                                                                                                                                        
                                                          name="probe_portal_backend_setting",                                                                                                                                                                                            
                                                          id="/subscriptions/**/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/applicationGateways/appgw-test7581/backendHttpSettingsCollection/backend_portal_http_setting",                 
                                                          interval=30,                                                                                                                                                                                                                    
                                                          min_servers=0,                                                                                                                                                                                                                 
                                                          path="/",                                                                                                                                                                                                                       
                                                          protocol="Http",                                                                                                                                                                                                               
                                                          timeout=30,                                                                                                                                                                                                                     
                                                          unhealthy_threshold=20,                                                                                                                                                                                                         
                                                          pick_host_name_from_backend_http_settings=True,                                                                                                                                                                                 
                                                      )],                                                                                                                                                                                                                                 
                                                      )

问题原因与修正方案 #

问题核心 #

代码中多处硬编码了不存在的网关appgw-test7581的资源ID，但当前要创建的网关是application_gateway_waf82529b3f，导致Azure找不到被引用的资源。

修正后的代码 #

移除所有硬编码的外部网关ID，改用Pulumi的apply方法动态获取当前网关内子资源的ID，确保所有关联都指向正在创建的网关：

application_gateway_waf = network.ApplicationGateway("application_gateway_waf",
                                                      location="eastus",
                                                      sku=network.ApplicationGatewaySkuArgs(
                                                          capacity=2,
                                                          name="Standard_v2",
                                                          tier="Standard_v2",
                                                      ),
                                                      resource_group_name='rg-waf-gx',
                                                      gateway_ip_configurations=[network.ApplicationGatewayIPConfigurationArgs(
                                                          name="appwg_ip_config",
                                                          subnet=network.SubResourceArgs(
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/virtualNetworks/test-waf-vnet7581/subnets/appgw-subnet",
                                                          ),
                                                      )],
                                                      frontend_ip_configurations=[network.ApplicationGatewayFrontendIPConfigurationArgs(
                                                          name="appgw_front_ip_config",
                                                          public_ip_address=network.SubResourceArgs(
                                                              id="/subscriptions/***/resourceGroups/rg-waf645-gx/providers/Microsoft.Network/publicIPAddresses/pip-appgw-waf7581",
                                                          ),
                                                      )],
                                                      frontend_ports=[network.ApplicationGatewayFrontendPortArgs(
                                                          name="appgw_front_port",
                                                          port=80,
                                                      )],
                                                      backend_address_pools=[network.ApplicationGatewayBackendAddressPoolArgs(
                                                          backend_addresses=[network.ApplicationGatewayBackendAddressArgs(
                                                              fqdn = "web-app-waf7581.azurewebsites.net",
                                                          )],
                                                          name="backend_portal",
                                                      )],
                                                      # 先定义探针，确保后端HTTP设置可以引用
                                                      probes=[network.ApplicationGatewayProbeArgs(
                                                          name="probe_portal_backend_setting",
                                                          interval=30,
                                                          min_servers=0,
                                                          path="/",
                                                          protocol="Http",
                                                          timeout=30,
                                                          unhealthy_threshold=20,
                                                          pick_host_name_from_backend_http_settings=True,
                                                      )],
                                                      backend_http_settings_collection=[network.ApplicationGatewayBackendHttpSettingsArgs(
                                                          name="backend_portal_http_setting",
                                                          protocol="http",
                                                          port=80,
                                                          cookie_based_affinity="Disabled",
                                                          request_timeout=20,
                                                          pick_host_name_from_backend_address=True,
                                                          # 动态引用当前网关内的探针
                                                          probe=network.SubResourceArgs(
                                                              id=application_gateway_waf.probes.apply(lambda probes: [p.id for p in probes if p.name == "probe_portal_backend_setting"][0])
                                                          ),
                                                      )],
                                                      http_listeners=[network.ApplicationGatewayHttpListenerArgs(
                                                          name="listener_portal",
                                                          # 动态引用当前网关的前端IP配置
                                                          frontend_ip_configuration=network.SubResourceArgs(
                                                              id=application_gateway_waf.frontend_ip_configurations.apply(lambda configs: [c.id for c in configs if c.name == "appgw_front_ip_config"][0])
                                                          ),
                                                          # 动态引用当前网关的前端端口
                                                          frontend_port=network.SubResourceArgs(
                                                              id=application_gateway_waf.frontend_ports.apply(lambda ports: [p.id for p in ports if p.name == "appgw_front_port"][0])
                                                          ),
                                                          protocol="http",
                                                          ssl_certificate= None,
                                                          host_name="portal1.mohsenakhavan.com",
                                                          require_server_name_indication= False,
                                                      )],
                                                      request_routing_rules=[network.ApplicationGatewayRequestRoutingRuleArgs(
                                                          name="rule_portal",
                                                          # 动态引用当前网关的后端地址池
                                                          backend_address_pool=network.SubResourceArgs(
                                                              id=application_gateway_waf.backend_address_pools.apply(lambda pools: [p.id for p in pools if p.name == "backend_portal"][0])
                                                          ),
                                                          # 动态引用当前网关的HTTP监听器
                                                          http_listener=network.SubResourceArgs(
                                                              id=application_gateway_waf.http_listeners.apply(lambda listeners: [l.id for l in listeners if l.name == "listener_portal"][0])
                                                          ),
                                                          # 动态引用当前网关的后端HTTP设置
                                                          backend_http_settings=network.SubResourceArgs(
                                                              id=application_gateway_waf.backend_http_settings_collection.apply(lambda settings: [s.id for s in settings if s.name == "backend_portal_http_setting"][0])
                                                          ),
                                                          priority=100,
                                                      )],
                                                      enable_http2=False,
                                                      )

关键修正点 #

1. 移除所有指向appgw-test7581的硬编码ID，改用apply方法从当前网关实例中动态获取子资源ID
2. 调整探针的定义顺序，确保后端HTTP设置引用探针时资源已存在
3. 所有子资源关联均指向正在创建的网关，避免引用不存在的外部资源

内容的提问来源于stack exchange，提问作者Shadi