Azure Functions与KeyVault的Terraform循环依赖问题求解

核心思路 #

和你手动操作的流程对齐，把循环依赖的资源拆分为独立的创建步骤：先创建启用身份的Azure Functions，再创建KeyVault，接着配置KeyVault访问策略，最后更新Functions的应用设置以引用KeyVault中的CosmosDB密钥。

具体通过两个关键调整打破循环：

• 将KeyVault的访问策略从KeyVault主资源中剥离，用独立的azurerm_key_vault_access_policy资源管理
• 将Functions中依赖KeyVault的应用设置（DB_KEY）拆分为独立的azurerm_function_app_app_setting资源，避免和Functions主资源绑定

修改后的代码示例 #

1. Functions模块（functions.tf） #

resource "azurerm_linux_function_app" "my_functions" {
  name                = "my-functions-app"
  resource_group_name = var.resource_group_name
  location            = var.location
  service_plan_id     = var.service_plan_id

  # 启用系统分配身份，用于KeyVault访问权限验证
  identity {
    type = "SystemAssigned"
  }

  # 仅配置不依赖KeyVault的基础应用设置
  app_settings = {
    "FUNCTIONS_WORKER_RUNTIME" = "python"
    # 其他基础配置项...
  }
}

# 单独管理依赖KeyVault的DB_KEY应用设置
resource "azurerm_function_app_app_setting" "db_key" {
  name          = "DB_KEY"
  value         = "@Microsoft.KeyVault(SecretUri=${module.key-vault.db_key_id})"
  function_app_id = azurerm_linux_function_app.my_functions.id

  # 确保访问策略配置完成后再设置，避免Functions启动时无权限访问密钥
  depends_on = [module.key-vault.functions_access_policy]
}

output "functions_principal_id" {
  value = azurerm_linux_function_app.my_functions.identity[0].principal_id
}

2. KeyVault模块（keyvault.tf） #

variable "functions_principal_id" {
  type = string
}

resource "azurerm_key_vault" "my_keyvault" {
  name                = "my-keyvault"
  resource_group_name = var.resource_group_name
  location            = var.location
  tenant_id           = var.tenant_id

  # 配置管理员基础访问策略，暂不包含Functions的权限
  access_policy {
    tenant_id = var.tenant_id
    object_id = var.admin_object_id

    secret_permissions = ["Get", "List", "Set"]
    # 其他所需权限...
  }

  sku_name = "standard"
}

# 独立配置Functions的KeyVault访问策略
resource "azurerm_key_vault_access_policy" "functions_access" {
  key_vault_id = azurerm_key_vault.my_keyvault.id
  tenant_id    = var.tenant_id
  object_id    = var.functions_principal_id

  secret_permissions = ["Get"]
}

# 将CosmosDB密钥存储到KeyVault
resource "azurerm_key_vault_secret" "db_key" {
  name         = "cosmos-db-key"
  value        = var.cosmos_db_key
  key_vault_id = azurerm_key_vault.my_keyvault.id
}

output "db_key_id" {
  value = azurerm_key_vault_secret.db_key.id
}

output "functions_access_policy" {
  value = azurerm_key_vault_access_policy.functions_access
}

3. 主配置（main.tf） #

module "functions" {
  source              = "./modules/functions"
  resource_group_name = azurerm_resource_group.my_rg.name
  location            = azurerm_resource_group.my_rg.location
  service_plan_id     = azurerm_service_plan.my_plan.id
}

module "key-vault" {
  source              = "./modules/key-vault"
  resource_group_name = azurerm_resource_group.my_rg.name
  location            = azurerm_resource_group.my_rg.location
  tenant_id           = data.azurerm_client_config.current.tenant_id
  admin_object_id     = data.azurerm_client_config.current.object_id
  functions_principal_id = module.functions.functions_principal_id
  cosmos_db_key       = azurerm_cosmosdb_account.my_cosmos.primary_key
}

方案原理 #

通过拆分资源打破了原模块间的双向引用：

• KeyVault模块仅单向依赖Functions的身份ID
• Functions的应用设置作为独立资源，单向依赖KeyVault的密钥和访问策略

Terraform会自动按以下顺序执行创建流程：

1. 创建Azure Functions（生成系统分配身份ID）
2. 创建KeyVault（完成基础配置）
3. 创建KeyVault访问策略（关联Functions身份）
4. 存储CosmosDB密钥到KeyVault
5. 更新Functions应用设置，添加KeyVault密钥引用

内容的提问来源于stack exchange，提问作者Michał Osik