如何使用Terraform基于Azure存储账户的bacpac备份创建SQL数据库

首先澄清认知：RestoreExternalBackup 用于恢复SQL Server原生备份的.bak格式文件，如果你要导入的是.bacpac格式的导出备份，推荐使用专门的azurerm_mssql_database_import资源实现需求。

完整可运行配置示例如下：

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_storage_account" "example" {
  name                     = "examplesa"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_mssql_server" "example" {
  name                         = "example-sqlserver"
  resource_group_name          = azurerm_resource_group.example.name
  location                     = azurerm_resource_group.example.location
  version                      = "12.0"
  administrator_login          = "4dm1n157r470r"
  administrator_login_password = "4-v3ry-53cr37-p455w0rd"
  public_network_access_enabled = true
}

# 可选：允许Azure服务访问SQL Server，避免导入任务被防火墙拦截
resource "azurerm_mssql_firewall_rule" "allow_azure_services" {
  name             = "AllowAzureServices"
  server_id        = azurerm_mssql_server.example.id
  start_ip_address = "0.0.0.0"
  end_ip_address   = "0.0.0.0"
}

# 直接通过bacpac导入创建数据库，无需单独声明azurerm_mssql_database资源
resource "azurerm_mssql_database_import" "from_bacpac" {
  name                = "acctest-db-d"
  server_id           = azurerm_mssql_server.example.id
  storage_key_type    = "StorageAccessKey"
  storage_key         = azurerm_storage_account.example.primary_access_key
  # 替换为你的bacpac文件实际存储路径
  storage_uri         = "https://${azurerm_storage_account.example.name}.blob.core.windows.net/你的备份容器名/你的备份文件名.bacpac"
  administrator_login = azurerm_mssql_server.example.administrator_login
  administrator_login_password = azurerm_mssql_server.example.administrator_login_password

  # 数据库SKU配置，和你原需求参数匹配
  edition             = "BusinessCritical"
  service_objective_name = "BC_Gen5_2"
  max_size_gb         = 4
}

# 审计策略单独配置，和导入逻辑解耦
resource "azurerm_mssql_database_extended_auditing_policy" "test" {
  database_id                             = azurerm_mssql_database_import.from_bacpac.id
  storage_endpoint                        = azurerm_storage_account.example.primary_blob_endpoint
  storage_account_access_key              = azurerm_storage_account.example.primary_access_key
  storage_account_access_key_is_secondary = false
  retention_in_days                       = 6
}

注意事项 #

• 如果你的bacpac文件存储在其他存储账户，直接替换storage_key和storage_uri为对应存储的访问密钥和文件地址即可
• 如果你确实要使用.bak格式的备份走RestoreExternalBackup模式，需要在azurerm_mssql_database资源中补充两个参数：external_backup_storage_uri（bak文件的blob访问地址）、external_backup_storage_access_key（存储账户访问密钥），同时确保备份文件是SQL Server原生备份格式、版本兼容目标SQL Server版本

内容的提问来源于stack exchange，提问作者Peter