如何使用Terraform为Azure Service Bus防火墙动态添加多个IP

• 每个Azure Service Bus命名空间仅对应1个网络规则集资源，你在azurerm_servicebus_namespace_network_rule_set资源层级添加了for_each参数，会导致Terraform为每个IP生成独立的规则集，和预期不符
• 代码存在笔误：你定义的本地IP列表变量名为ip_rules，引用时错误写为了ip_rules1

ip_rules参数本身就支持传入IP/CIDR格式的字符串列表，直接将你预定义的local.ip_rules赋值给该参数即可批量动态添加IP白名单，无需使用for_each循环。

修正后完整代码如下：

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_servicebus_namespace" "example" {
  name                = "example-sb-namespace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "Premium"
  capacity = 1
}

resource "azurerm_virtual_network" "example" {
  name                = "example-vnet"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["172.17.0.0/16"]
  dns_servers         = ["10.0.0.4", "10.0.0.5"]
}

resource "azurerm_subnet" "example" {
  name                 = "default"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["172.17.0.0/24"]
  service_endpoints = ["Microsoft.ServiceBus"]
}

locals {
   ip_rules = [
     "1.1.1.1",
     "2.2.2.2",
     "123.145.168.143",
     "1.23.54.67",
     "145.36.142.127",
     "192.168.0.0/24",
     "194.145.123.0/26"
   ]
}

resource "azurerm_servicebus_namespace_network_rule_set" "example" {
  namespace_name      = azurerm_servicebus_namespace.example.name
  resource_group_name = azurerm_resource_group.example.name

  default_action = "Deny"
  trusted_services_allowed = true

  network_rules {
    subnet_id                            = azurerm_subnet.example.id
    ignore_missing_vnet_service_endpoint = false
  }

  # 直接传入本地IP列表即可批量添加规则
  ip_rules = local.ip_rules
}

后续需要新增/删除IP规则时，只需要修改local.ip_rules列表的内容，重新执行Terraform apply就会自动更新规则集，不会重复创建资源。

内容的提问来源于stack exchange，提问作者devops-admin