在一个订阅中维护 terraform azure state 文件并部署到多个云订阅答案

【问题标题】：maintain terraform azure state file in one subscription and deploy to multiple cloud subscriptions在一个订阅中维护 terraform azure state 文件并部署到多个云订阅
【发布时间】：2021-11-09 09:03:42
【问题描述】：

我需要将我的 terraform 状态文件存储在一个 azure 存储帐户中，并将其部署到多个云订阅（中国和公共云）.. 我的后端配置如下：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.78.0"
    }
  }
  backend "azurerm" {
    resource_group_name = "Terraform-rg"
    storage_account_name = "terraformstate"
    container_name = "tfstate"
    subscription_id = "00000000-0000-0000-0000-000000000000"
    key = "prod"
  }
}

provider "azurerm" {
  features {}
}


provider "azurerm" {
  features {}
  alias           = "sub2"
  subscription_id = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  client_id       = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  client_secret   = var.client_secret
  tenant_id       = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
}

但是，当我尝试使用这种方法对 init 进行 terraform init 时，我收到以下错误：

Failed to get configured named states: Error retrieving keys for Storage Account "terraformstate": storage.AccountsClient#ListKeys: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="SubscriptionNotFound" Message="The subscription 'xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx' could not be found."

我想知道是否有可能做到这一点？我还有一个脚本来 terraform init 和 terraform plan 将基于 env 切换云.. "az cloud set --name AzureChinaCloud" 适用于中国和非中国 "az cloud set --name AzureCloud" 存储账户订阅在AzureCloud.. 如何授权在AzureCloud中写入AzureChinaCloud的状态文件？这种方法甚至可能吗？

【问题讨论】：

您好@pk_dhruv，设置云不需要其他脚本，您可以直接在提供程序块中添加环境参数。你可以参考这个SO thread
对于未找到订阅错误，您可以先尝试上述建议，然后执行terraform init。由于您已从 cli 设置了可能，因此可能会产生问题。
如果以上解决了问题，请告诉我
@AnsumanBal-MT.. 是的.. 你提到的链接成功了.. 我错过了添加环境，这导致了问题.. 在我添加了环境之后，事情开始像预期..谢谢你的帮助！！
cool.. 很高兴能提供帮助将发布与答案相同的内容。

标签： terraform terraform-provider-azure azure-rm

【解决方案1】：

正如评论部分所述，您的代码中的问题是您在 provider 块中缺少 Environment 参数。由于您手动设置云环境，因此代码无法在公共云中的后端配置中找到订阅。

因此，解决方案将在下面的代码中设置参数，而不是手动使用az CLI：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.78.0"
    }
  }
  backend "azurerm" {
    resource_group_name = "Terraform-rg"
    storage_account_name = "terraformstate"
    container_name = "tfstate"
    subscription_id = "00000000-0000-0000-0000-000000000000"
    key = "prod"
  }
}

provider "azurerm" {
  features {}
}


provider "azurerm" {
  features {}
  alias           = "USGovernment"
  subscription_id = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  client_id       = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  client_secret   = var.client_secret
  tenant_id       = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  environment     = "usgovernment"
}

provider "azurerm" {
  features {}
  alias           = "China"
  subscription_id = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  client_id       = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  client_secret   = var.client_secret
  tenant_id       = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
  environment     = "china"
}

参考：

Docs overview | hashicorp/azurerm | Terraform Registry

SO thread

【讨论】：