尝试在Azure云提供者上创建私有链接时出现问题

问题描述

我正在尝试开发terraform脚本，该脚本在Azure上创建虚拟机，并使用专用链接将其连接到Azure Postgresql实例。我总是会收到此错误：

Error: creating Private Endpoint "n4gx6y-endpoint" (Resource Group "PGsqlResourceGroup"): 
network.PrivateEndpointsClient#CreateOrUpdate: 
Failure sending request: StatusCode=400 -- Original Error: 
Code="IncorrectPrivateLinkServiceConnectionGroupId" 
Message="Call to Microsoft.DBforPostgresql/servers Failed. 
Error message: Private Link Service Connection Group Id is 
incorrect for Azure Database for Postgresql" Details=[]

  on main.tf line 68,in resource "azurerm_private_endpoint" "example":
  68: resource "azurerm_private_endpoint" "example" {

这是脚本：

# -*- mode: hcl; coding: utf-8; -*-
# vim: set Syntax=hcl fileencoding=utf-8

terraform {
  required_version = ">= 0.12,< 0.13"
}

provider "azurerm" {
  version                 = ">=2.20"
  subscription_id         = var.subscription_id
  client_id               = var.client_id
  client_certificate_path = var.client_certificate_path
  tenant_id               = var.tenant_id
  features {}
}

provider "random" {
  version = "~> 2.3"
}

resource "random_string" "random" {
  length  = 6
  special = false
  upper   = false
}

resource "azurerm_resource_group" "grp" {
  name     = "PGsqlResourceGroup"
  location = var.location

  tags = {
    environment = "terraform Demo"
  }
}

resource "azurerm_virtual_network" "example" {
  name                = "${random_string.random.result}-network"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.grp.location
  resource_group_name = azurerm_resource_group.grp.name
}

resource "azurerm_subnet" "example" {
  name                                           = "${random_string.random.result}-subnet"
  resource_group_name                            = azurerm_resource_group.grp.name
  virtual_network_name                           = azurerm_virtual_network.example.name
  address_prefixes                               = ["10.0.1.0/24"]
  enforce_private_link_endpoint_network_policies = true
}

resource "azurerm_postgresql_server" "example" {
  name                = "${random_string.random.result}-pg"
  location            = azurerm_resource_group.grp.location
  resource_group_name = azurerm_resource_group.grp.name

  sku_name = "GP_Gen5_2"

  backup_retention_days        = 7
  geo_redundant_backup_enabled = false
  storage_mb                   = 51200
  auto_grow_enabled            = true
  administrator_login          = "MysqLadmin"
  administrator_login_password = "H@Sh1CoR3!"
  version                      = "11"
  ssl_enforcement_enabled      = true
}

resource "azurerm_private_endpoint" "example" {
  name                = "${random_string.random.result}-endpoint"
  location            = azurerm_resource_group.grp.location
  resource_group_name = azurerm_resource_group.grp.name
  subnet_id           = azurerm_subnet.example.id

  private_service_connection {
    name                           = "${random_string.random.result}-privateserviceconnection"
    private_connection_resource_id = azurerm_postgresql_server.example.id
    subresource_names              = ["postgresServer"]
    is_manual_connection           = false
  }
}

这是github仓库，具有相同的脚本，一个用于Postgres，一个用于Mariadb。该错误仅在Postgres中出现。

https://github.com/kiklop74/terraform-private-link-issue

解决方法

问题实际上与脚本的这一部分有关：

  private_service_connection {
    name                           = "${random_string.random.result}-privateserviceconnection"
    private_connection_resource_id = azurerm_postgresql_server.example.id
    subresource_names              = ["postgresServer"] # <-- HERE!
    is_manual_connection           = false
  }

事实证明，每个受支持的专用链接的Azure管理服务都有硬编码的子资源名称。对于MariaDB实例，它是mariadbServer，对于Postgres是postgresqlServer。我错误地将其放置在postgresServer那里，认为它只是任意值。