面临Terraform KeyVault证书创建问题

Question

大家好，我面临的问题是，我有一个脚本，我在其中创建资源组和密钥库，当我单独创建RG和密钥库时，我将凭据从中央KV复制到新的KV中，然后将凭据复制部分添加到脚本中，所有内容都会创建，但当我将发生1 RG和1 KV的代码与凭据副本结合在一起时，它会显示错误RG中的密钥保管库不存在。我在问，在地形中有什么顺序需要我遵循吗？资源.tf

resource "azurerm_resource_group" "main" {
name     = "${var.prefix}-resourceGB"
location = var.location
}
# --- Get reference to logged on Azure subscription ---
data "azurerm_client_config" "current" {}

resource "azurerm_key_vault" "New" {
name                        = "KV1"
location                    = azurerm_resource_group.main.location
resource_group_name         = azurerm_resource_group.main.name
enabled_for_disk_encryption = true
tenant_id                   = data.azurerm_client_config.current.tenant_id
soft_delete_enabled         = true
purge_protection_enabled    = false

sku_name = "standard"

access_policy {
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
certificate_permissions = [
"create",
"delete",
"deleteissuers",
"get",
"getissuers",
"import",
"purge",
"list",
"listissuers",
"managecontacts",
"manageissuers",
"setissuers",
"update",
]
key_permissions = [
"backup",
"create",
"decrypt",
"delete",
"encrypt",
"get",
"import",
"list",
"purge",
"recover",
"restore",
"sign",
"unwrapKey",
"update",
"verify",
"wrapKey",
]
secret_permissions = [
"backup",
"delete",
"get",
"list",
"purge",
"recover",
"restore",
"set",
]

}
}
data "azurerm_key_vault" "existing" {
name                = "Old-KV"
resource_group_name = "Old-RG"
}
data "azurerm_key_vault" "New" {
name                = "KV1"
resource_group_name = "${var.prefix}-resourceGB"
}
module "Cert1" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert1"
destination_key_vault_id = data.azurerm_key_vault.New.id
destination_key_vault_cert_name = "Cert1"
}
module "Cert2" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert2"
destination_key_vault_id = data.azurerm_key_vault.New.id
destination_key_vault_cert_name = "Cert2"
}

复制证书main.tf

data "azurerm_key_vault_secret" "source_KV_cert" {
name         = var.source_key_vault_cert_name
key_vault_id = var.source_key_vault_id
}

data "azurerm_key_vault_certificate" "source_cert" {
name         = var.source_key_vault_cert_name
key_vault_id = var.source_key_vault_id
}

resource "azurerm_key_vault_certificate" "dest_cert" {
name         = var.destination_key_vault_cert_name
key_vault_id = var.destination_key_vault_id

certificate {
contents = data.azurerm_key_vault_secret.source_KV_cert.value
}

certificate_policy {
issuer_parameters {
name = "self"
}

key_properties {
exportable = true
key_size   = 2048
key_type   = "RSA"
reuse_key  = true
}

secret_properties {
content_type = "application/x-pkcs12"
}

}

}

复制证书变量.tf

variable "source_key_vault_id" {
type    = string
}
variable "source_key_vault_cert_name" {
type    = string
}
variable "destination_key_vault_id" {
type    = string
}
variable "destination_key_vault_cert_name" {
type    = string
}

Answer 1

由于使用resource "azurerm_key_vault"创建新的密钥保管库，因此无法使用数据源查询当时在同一.tf文件中的模块module "Cert1"和module "Cert2"中创建的新资源。数据"；azurerm_key_vault"；用于访问有关现有密钥库的信息。

因此，更改文件Resource.tf中的相关代码，如下所示：

# data "azurerm_key_vault" "New" {
#   name                = "KV1"
#   resource_group_name = "${var.prefix}-resourceGB"
# }
module "Cert1" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert1"
destination_key_vault_id = azurerm_key_vault.New.id     # changed
destination_key_vault_cert_name = "Cert1"
}
module "Cert2" {
source = "../module/copy_cert"
source_key_vault_id = data.azurerm_key_vault.existing.id
source_key_vault_cert_name = "Cert2"
destination_key_vault_id = azurerm_key_vault.New.id      # changed
destination_key_vault_cert_name = "Cert2"
}