在地形中基于区域创建角色分配

Question

我在Terraform上寻找一个解决方案，用于创建角色分配和选择基于区域的主体id。如果我要在中国运行代码，变量应该是"local.principal_ids_cn"。如果是全局的，那么它必须是"local.principal_id"。我有一个env变量，地理位置将根据cluster-name设置。所以"if geo = cn use local。Principal_ids_cn，否则使用local.principal_id "如何将其整合到terraform中?

这是我的输入文件:

"applications" : [
{
"principal_id" : "00000000-000000-global-000000000000", 
"principal_id_cn" : "00000000-000000-china-000000000000",
}
]
}

我的资源块是这样的:

locals {
# get json
role_data = jsondecode(file(var.inputfile))
principal_ids = distinct([for principal in local.role_data.applications : principal.principal_id])
principal_ids_cn = distinct([for principal_cn in local.role_data.applications : principal.principal_id_cn])
}
data "azurerm_subscription" "primary" {}
resource "azurerm_role_assignment" "custom" {
for_each = toset(local.principal_ids)
scope = data.azurerm_subscription.primary.id
role_definition_name = var.custom_role
principal_id = each.key
}
resource "azurerm_role_assignment" "builtin" {
for_each = toset(local.principal_ids)
scope = data.azurerm_subscription.primary.id
role_definition_name = var.builtin_role
principal_id = each.key
}

variables.tf:

variable "custom_role" {
type = string
description = "custom role"
default = "READER"
}
variable "builtin_role" {
type = string
description = "builtin role"
default = "My_built_in_role"
}

是否有可能根据地区(中国和全球)切换本地变量?有什么建议和想法可以实现这一点吗?

Answer 1

您可以在Terraform中使用条件表达式来实现逻辑"if geo = cn use local。Principal_ids_cn，否则使用local.principal_ids">

资源块的地形代码:

locals {
# get json
role_data = jsondecode(file(var.inputfile))
principal_ids = distinct([for principal in local.role_data.applications : principal.principal_id])
principal_ids_cn = distinct([for principal_cn in local.role_data.applications : principal.principal_id_cn])
principal = (var.geo == "cn" ? local.principal_ids_cn : local.principal_ids)
}
data "azurerm_subscription" "primary" {}
resource "azurerm_role_assignment" "custom" {
for_each = toset(local.principal_ids)
scope = data.azurerm_subscription.primary.id
role_definition_name = var.custom_role
principal_id = each.key
}
resource "azurerm_role_assignment" "builtin" {
for_each = toset(local.principal_ids)
scope = data.azurerm_subscription.primary.id
role_definition_name = var.builtin_role
principal_id = each.key
}

https://www.terraform.io/docs/language/expressions/conditionals.html