Terraform创建带UMI的SQL Server时提示缺少必填参数错误

问题场景 #

执行Terraform代码创建绑定用户分配托管身份（UMI, User Managed Identity）的Azure SQL Server资源时触发执行错误。

原始配置代码 #

resource "azurerm_mssql_server" "sql_server" {
  name                = var.sql_server_name
  resource_group_name = var.rg_name
  location            = var.rg_location
  version             = var.server_version
  administrator_login = var.admin_login
  administrator_login_password = "Rock2424"
  outbound_network_restriction_enabled = true
  minimum_tls_version                  = "1.2"

  dynamic "identity" {
    for_each = var.enable_manage_identity == false ? toset([]) : toset([1])
    content {
      type         = "UserAssigned"
      identity_ids = [azurerm_user_assigned_identity.user_assigned_identity.id]
    }
  }
  primary_user_assigned_identity_id = azurerm_user_assigned_identity.user_assigned_identity[0].id
  azuread_administrator {
    login_username = var.ad_admin_server
    object_id      = var.ad_admin_server_object_id
  }
  tags = var.tags
}

resource "azurerm_user_assigned_identity" "user_assigned_identity" {
  count               = var.enable_manage_identity ? 1 : 0
  name                = "${var.sql_server_name}-identity"
  location            = var.rg_location
  resource_group_name = var.rg_name
}

报错信息 #

错误：缺少必填参数（Missing required argument）
错误关联资源：azurerm_mssql_server.sql_server，位于main.tf文件第25行，对应配置为：
primary_user_assigned_identity_id = azurerm_user_assigned_identity.user_assigned_identity[0].id
错误提示："primary_user_assigned_identity_id": 必须同时指定identity.0.identity_ids,primary_user_assigned_identity_id两项配置

问题根因 #

• primary_user_assigned_identity_id参数没有做条件判断，无论var.enable_manage_identity是true还是false，Terraform都会尝试解析该参数值。当开关为false时，azurerm_user_assigned_identity资源的count为0，此时不仅取[0].id会触发索引越界，还会出现配置了主UMI参数、但未生成对应identity块绑定UMI列表的情况，触发参数校验错误。
• identity动态块内的identity_ids引用错误：使用count创建的托管身份资源返回值是列表类型，直接取.id属性无法拿到正确的资源ID，必须指定索引[0]。

修复方案 #

调整两个配置点：

• 给primary_user_assigned_identity_id增加和identity块一致的条件判断，仅在开启托管身份时赋值，关闭时传null即可跳过参数校验
• 修正identity块内托管身份ID的引用方式，正确读取count模式创建的UMI资源的索引值

修复后完整代码如下：

resource "azurerm_mssql_server" "sql_server" {
  name                = var.sql_server_name
  resource_group_name = var.rg_name
  location            = var.rg_location
  version             = var.server_version
  administrator_login = var.admin_login
  administrator_login_password = "Rock2424"
  outbound_network_restriction_enabled = true
  minimum_tls_version                  = "1.2"

  dynamic "identity" {
    for_each = var.enable_manage_identity == false ? toset([]) : toset([1])
    content {
      type         = "UserAssigned"
      # 修正count资源的ID引用
      identity_ids = [azurerm_user_assigned_identity.user_assigned_identity[0].id]
    }
  }
  # 增加条件判断，仅开启UMI时配置该参数
  primary_user_assigned_identity_id = var.enable_manage_identity ? azurerm_user_assigned_identity.user_assigned_identity[0].id : null
  azuread_administrator {
    login_username = var.ad_admin_server
    object_id      = var.ad_admin_server_object_id
  }
  tags = var.tags
}

resource "azurerm_user_assigned_identity" "user_assigned_identity" {
  count               = var.enable_manage_identity ? 1 : 0
  name                = "${var.sql_server_name}-identity"
  location            = var.rg_location
  resource_group_name = var.rg_name
}

调整后执行terraform plan即可通过参数校验，不会再出现必填参数缺失的报错。

内容的提问来源于stack exchange，提问作者Daman Malik