如何用Terraform Azure Provider通过单资源块动态创建VNET及子网

核心通过Terraform的for_each元参数配合结构化配置集合，仅用1个VNET资源块、1个子网资源块即可完成多套VNET和对应子网的动态创建，无需重复定义资源块。

完整实现代码 #

# 定义全局统一配置，所有VNET、子网参数均在此处维护
locals {
  # 公共参数可抽离单独定义
  default_location       = "eastus"
  default_resource_group = "test-rg"

  vnet_configs = {
    # test环境VNET配置
    test = {
      name          = "test"
      address_space = ["10.0.0.0/16"]
      location      = local.default_location
      resource_group = local.default_resource_group
      subnets = {
        test1-subnet = "10.0.1.0/24"
        test2-subnet = "10.0.2.0/24"
      }
    }
    # dev环境VNET配置
    dev = {
      name          = "dev"
      address_space = ["10.1.0.0/16"]
      location      = local.default_location
      resource_group = local.default_resource_group
      subnets = {
        dev1-subnet = "10.1.1.0/24"
        dev2-subnet = "10.1.2.0/24"
      }
    }
  }

  # 打平所有子网配置，生成一维列表供子网资源块遍历
  all_subnets = flatten([
    for vnet_key, vnet_config in local.vnet_configs : [
      for subnet_name, subnet_cidr in vnet_config.subnets : {
        vnet_key        = vnet_key
        vnet_name       = vnet_config.name
        subnet_name     = subnet_name
        subnet_cidr     = subnet_cidr
        resource_group  = vnet_config.resource_group
      }
    ]
  ])
}

# 单个VNET资源块，动态创建所有VNET
resource "azurerm_virtual_network" "vnet" {
  for_each            = local.vnet_configs
  name                = each.value.name
  address_space       = each.value.address_space
  location            = each.value.location
  resource_group_name = each.value.resource_group
}

# 单个子网资源块，动态创建所有VNET下的所有子网
resource "azurerm_subnet" "subnet" {
  for_each = { for subnet in local.all_subnets : "${subnet.vnet_key}-${subnet.subnet_name}" => subnet }

  name                 = each.value.subnet_name
  resource_group_name  = each.value.resource_group
  virtual_network_name = azurerm_virtual_network.vnet[each.value.vnet_key].name
  address_prefixes     = [each.value.subnet_cidr]

  enforce_private_link_endpoint_network_policies = true
}

实现说明 #

• 所有VNET、子网的配置均收敛到local.vnet_configs中，后续新增VNET或子网只需修改该配置集合，无需调整资源块代码
• for_each使用自定义的唯一字符串作为资源索引，避免配置顺序调整导致的资源意外重建
• 子网资源通过azurerm_virtual_network.vnet[each.value.vnet_key].name自动关联对应VNET，无需手动维护依赖关系
• 执行terraform plan可验证会生成2个VNET、4个子网资源，与需求完全匹配

内容的提问来源于stack exchange，提问作者devops-admin