Terraform部署Azure App Service与应用注册出现循环依赖如何解决

问题原因 #

你当前的配置存在双向依赖：

• azurerm_app_service.app 依赖 azuread_application.appregistration 的 application_id 来填充app_settings
• azuread_application.appregistration 依赖 azurerm_app_service.app 的 name 作为自己的display_name
  Terraform无法确定两个资源的创建顺序，因此抛出循环依赖报错。

解决方案1：统一使用变量定义应用名称（最简便） #

直接将应用注册的display_name和App Service的name绑定同一个变量var.app_service_name，打破互相引用：

resource "azurerm_app_service" "app" {
  name                = var.app_service_name
  location            = var.resource_group_location
  resource_group_name = azurerm_resource_group.rg.name
  app_service_plan_id = azurerm_app_service_plan.plan-app.id

  app_settings = {
    "AzureAd:ClientId" = azuread_application.appregistration.application_id
  }

  site_config {
    ftps_state = var.app_service_ftps_state
  }
}

resource "azuread_application" "appregistration" {
  # 改为直接引用变量，不再依赖App Service资源属性
  display_name                   = var.app_service_name
  owners                         = [data.azuread_client_config.current.object_id]
  sign_in_audience               = "AzureADMyOrg"
  fallback_public_client_enabled = true

  web {
    homepage_url  = var.appreg_web_homepage_url
    logout_url    = var.appreg_web_logout_url
    redirect_uris = [var.appreg_web_homepage_url, var.appreg_web_redirect_uri]

    implicit_grant {
      access_token_issuance_enabled = true
      id_token_issuance_enabled     = true
    }
  }
}

该方案资源创建顺序为：先创建Azure AD应用注册，再创建App Service，符合依赖逻辑。

解决方案2：拆分App Service配置为独立资源 #

如果你必须使用App Service的动态返回name作为应用注册的显示名，可以把app_settings拆分为独立的azurerm_app_service_setting资源，解除循环：

# 先创建不带AzureAd配置的App Service
resource "azurerm_app_service" "app" {
  name                = var.app_service_name
  location            = var.resource_group_location
  resource_group_name = azurerm_resource_group.rg.name
  app_service_plan_id = azurerm_app_service_plan.plan-app.id

  site_config {
    ftps_state = var.app_service_ftps_state
  }
}

# 再创建应用注册，引用App Service的name
resource "azuread_application" "appregistration" {
  display_name                   = azurerm_app_service.app.name
  owners                         = [data.azuread_client_config.current.object_id]
  sign_in_audience               = "AzureADMyOrg"
  fallback_public_client_enabled = true

  web {
    homepage_url  = var.appreg_web_homepage_url
    logout_url    = var.appreg_web_logout_url
    redirect_uris = [var.appreg_web_homepage_url, var.appreg_web_redirect_uri]

    implicit_grant {
      access_token_issuance_enabled = true
      id_token_issuance_enabled     = true
    }
  }
}

# 最后单独配置App Service的应用设置，引用应用注册的ID
resource "azurerm_app_service_setting" "azuread_client_id" {
  app_service_name = azurerm_app_service.app.name
  resource_group_name = azurerm_resource_group.rg.name
  name  = "AzureAd:ClientId"
  value = azuread_application.appregistration.application_id
}

该方案资源创建顺序为：创建App Service → 创建Azure AD应用注册 → 配置App Service设置，完全规避循环依赖。

内容的提问来源于stack exchange，提问作者Cristian