Связанная служба синапса Azure для функции Azure в Terraform

Я попытался воспроизвести сценарий в своей среде.

Пробовал ниже код:

resource "azurerm_synapse_linked_service" "example" {
  name                 = "kavya-fnapplinked"
  synapse_workspace_id = azurerm_synapse_workspace.example.id
  type                 = "AzureFunction"
  type_properties_json = <<JSON
    {
      "functionAppUrl": "https://${data.azurerm_function_app.example.default_hostname}",
      "authentication": "Anonymous",
     "functionKey": "${data.azurerm_function_app_host_keys.example.default_function_key}"
}
JSON
depends_on = [
    azurerm_synapse_firewall_rule.allowAll,
    data.azurerm_function_app.example,
    data.azurerm_function_app_host_keys.example
  ]

}

Возникли ошибки из-за того, что свойство json и функциональный ключ не были сгенерированы должным образом, поскольку они имеют неправильный формат.

Для этого обратите внимание на два важных момента:

1. Функциональный ключ создается только после того, как приложение-функция создано первым и является конфиденциальным значением.
2. Формат Json для конфиденциальных значений должен быть в формате ниже

"secret": 
                 {
                "type": "SecureString",
                "value":  “{value}"
               }

• Сначала я сохранил функциональный ключ в keyvalut , поэтому для его создания и сохранения в секрете требуется время.

Код:

resource "azurerm_role_assignment" "role_assignment" {
  scope                = azurerm_storage_account.stfn.id
  role_definition_name = "Storage Blob Data Owner"
  principal_id         = data.azurerm_client_config.current.object_id
}

# used Sleep to wait for role assignment to take its time to propagate
resource "time_sleep" "role_assignment_sleep" {
  create_duration = "60s"

  triggers = {
    role_assignment = azurerm_role_assignment.role_assignment.id
  }
}


resource "azurerm_storage_data_lake_gen2_filesystem" "example" {
  name               = "kavdatalakexample123"
  storage_account_id = azurerm_storage_account.stfn.id
   depends_on         = [time_sleep.role_assignment_sleep]
}

resource "azurerm_synapse_workspace" "example" {
  name                = "exmple-workspace"
  resource_group_name = data.azurerm_resource_group.example.name
  location            = data.azurerm_storage_account.example.location
  storage_data_lake_gen2_filesystem_id = azurerm_storage_data_lake_gen2_filesystem.example.id
  sql_administrator_login              = "sqladminuser"
  sql_administrator_login_password     = "H@Sh1CoR3!"
  managed_virtual_network_enabled      = true
  identity {
    type = "SystemAssigned"
  }

}



resource "azurerm_synapse_firewall_rule" "allowAll" {
  name                 = "allowAll"
  synapse_workspace_id = azurerm_synapse_workspace.example.id
  start_ip_address     = "0.0.0.0"
  end_ip_address       = "255.255.255.255"
}


resource "azurerm_storage_account" "stfn" {
  name                     = "kaexpleaccforfunct"
   resource_group_name = data.azurerm_resource_group.example.name
  location            = data.azurerm_storage_account.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}


resource "azurerm_app_service_plan" "example" {
  name                = "exm-kavya-app-service-plan"
  resource_group_name = data.azurerm_resource_group.example.name
  location            =data.azurerm_storage_account.example.location
  kind                = "FunctionApp"
  sku {
    tier = "Dynamic"
    size = "Y1"
  }
}
resource "azurerm_function_app" "example" {
  name                      = "exm-kavya-function-app"
  resource_group_name = data.azurerm_resource_group.example.name
  location            = data.azurerm_resource_group.example.location
 // storage_connection_string = azurerm_storage_account.stfn.primary_connection_string
  storage_account_name       = azurerm_storage_account.stfn.name
  storage_account_access_key = azurerm_storage_account.stfn.primary_access_key
  app_service_plan_id       = azurerm_app_service_plan.example.id
}




data "azurerm_function_app_host_keys" "example" {
 resource_group_name = data.azurerm_resource_group.example.name
 name= azurerm_function_app.example.name
  
}

output "function_key" {
  value = data.azurerm_function_app_host_keys.example.default_function_key
   sensitive = true
}

output "function_appurl" {
  value = "https://${azurerm_function_app.example.default_hostname}"
}



resource "azurerm_key_vault" "example" {
  name                        = "kavyaexamplekeyvault"
  location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  enabled_for_disk_encryption = true
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  soft_delete_retention_days  = 7
  purge_protection_enabled    = false

  sku_name = "standard"

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = data.azurerm_client_config.current.object_id

   
    key_permissions = [
      "Create",
      "Get",
    ]

    secret_permissions = [
      "Set",
      "Get",
      "Delete",
      "Purge",
      "Recover",
      "List"
    ]

    storage_permissions = [
      "Get","Set"
    ]
  }
}

resource "azurerm_key_vault_secret" "example" {
  name         = "functionkey"
  value        = data.azurerm_function_app_host_keys.example.default_function_key
  key_vault_id = azurerm_key_vault.example.id
}

resource "azurerm_synapse_linked_service" "example" {
  name                 = "kav-fnapplinked"
  synapse_workspace_id = azurerm_synapse_workspace.example.id
  type                 = "AzureFunction"
  type_properties_json = <<JSON
    {
       
  "functionAppUrl": "https://${azurerm_function_app.example.default_hostname}",
  "authentication": "Anonymous",
  "functionKey": 
             {
            "type": "SecureString",
            "value":  "${azurerm_key_vault_secret.example.value}"
           }
      "authentication": "Anonymous",
      "functionKey": 
                 {
                "type": "SecureString",
                "value":  "${azurerm_key_vault_secret.example.value}"
               }
}
JSON

depends_on = [
    azurerm_synapse_firewall_rule.allowAll,
    azurerm_function_app.example,
    data.azurerm_function_app_host_keys.example
  ]

}

С приведенным выше кодом я смог успешно создать связанную службу.

Связанная служба для рабочей области Azure Synapse:

Ссылка: azure — проблема с Terraform при создании ресурса «azurerm_synapse_linked_service» конкретно с полем «type_properties_json» – 2 Ответа