如何使用Terraform在Azure应用服务中为静态出站IP设置NAT网关

pw9qyyiw 于 2023-08-07 发布在其他

关注(0)|答案(1)|浏览(93)

我正在开发一个ASP.NET Core Web API，我计划将其部署为Azure应用服务。API与Binance交互，这需要填写与我的API密钥相关联的IP地址。
在对Azure中的静态IP进行了一些研究之后，我发现我可以使用NAT网关来实现静态出站IP，这正是我在Binance中所需要的。不过，我一直有一些困难设置它。
这就是我目前所做的。
问题：

有人能验证我是否正确地设置了基于文章https://www.azureblue.io/how-to-use-fix-ips-with-azure-app-service的静态出站IP的NAT网关吗？

的数据
我看到过一些示例，其中使用私有端点在虚拟网络中的Azure App Service和Azure SQL数据库之间路由流量。我是否应该考虑在当前的设置中实现此功能？请详细说明。
是否建议将我的资源分隔到不同的子网（例如，prod-eastus-linuxapp-snet和prod-eastus-sqlserver-snet）？
如何确认它在技术上有效？从理论上讲，它应该做它应该做的事情。

resource "azurerm_service_plan" "asp" {
  name                = "${local.basename}-asp"
  resource_group_name = module.resource_group.name
  location            = var.location
  os_type             = "Linux"
  sku_name            = "S1"
}

resource "azurerm_linux_web_app" "app" {
  name                = "${local.basename}-app"
  resource_group_name = module.resource_group.name
  location            = var.location
  service_plan_id     = azurerm_service_plan.asp.id

  site_config {
    vnet_route_all_enabled = true # WEBSITE_VNET_ROUTE_ALL
  }

  tags = var.tags
}

resource "azurerm_virtual_network" "vnet" {
  name                = "${local.basename}-vnet"
  resource_group_name = module.resource_group.name
  location            = var.location
  address_space       = ["10.0.0.0/16"]

  tags = var.tags
}

resource "azurerm_subnet" "snet" {
  name                 = "${local.basename}-linuxapp-snet"
  resource_group_name  = module.resource_group.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]

  delegation {
    name = "delegation"

    service_delegation {
      name    = "Microsoft.Web/serverFarms"
      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
    }
  }
}

resource "azurerm_subnet_nat_gateway_association" "example" {
  subnet_id      = azurerm_subnet.snet.id
  nat_gateway_id = azurerm_nat_gateway.ng.id
}

resource "azurerm_public_ip" "pip" {
  name                = "${local.basename}-pip"
  resource_group_name = module.resource_group.name
  location            = var.location
  allocation_method   = "Static"
  sku                 = "Standard"

  tags = var.tags
}

resource "azurerm_nat_gateway" "ng" {
  name                    = "${local.basename}-ng"
  resource_group_name     = module.resource_group.name
  location                = var.location
  sku_name                = "Standard"
  idle_timeout_in_minutes = 10

  tags = var.tags
}

resource "azurerm_nat_gateway_public_ip_association" "association" {
  nat_gateway_id       = azurerm_nat_gateway.ng.id
  public_ip_address_id = azurerm_public_ip.pip.id
}

resource "azurerm_app_service_virtual_network_swift_connection" "example" {
  app_service_id = azurerm_linux_web_app.app.id
  subnet_id      = azurerm_subnet.snet.id
}

字符串

Azure

来源：https://stackoverflow.com/questions/76764119/how-to-set-up-nat-gateway-for-static-outbound-ip-in-an-azure-app-service-using-t

1条答案

按热度按时间

biswetbf1#

我尝试使用Terraform在Azure应用服务中为静态出站IP设置NAT网关。
为了实现查询中提到的配置，我们需要通过NAT网关将Web应用与应用服务计划集成。
下面是该需求的完整配置。

main.tf

resource "azurerm_resource_group" "example" {
  name     = "demorgvk"
  location = "East US"
}

resource "azurerm_service_plan" "asp" {
  name                = "demock-asp"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  os_type             = "Linux"
  sku_name            = "P1v2"
}

resource "azurerm_virtual_network" "vnet" {
  name                = "demovk-vnet"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "snet" {
  name                 = "demovk-linuxapp-snet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]

  delegation {
    name = "delegation"

    service_delegation {
      name    = "Microsoft.Web/serverFarms"
      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
    }
  }
}

resource "azurerm_nat_gateway" "nat" {
  name                = "demovk-nat"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  //subnets             = [azurerm_subnet.snet.id]
  //public_ip_address   = [azurerm_public_ip.nat_ip.id]
  sku_name                = "Standard"
  idle_timeout_in_minutes = 10
  zones                   = ["1"]
}

resource "azurerm_subnet_nat_gateway_association" "example" {
  subnet_id      = azurerm_subnet.snet.id
  nat_gateway_id = azurerm_nat_gateway.nat.id
}

resource "azurerm_nat_gateway_public_ip_association" "association" {
  nat_gateway_id       = azurerm_nat_gateway.nat.id
  public_ip_address_id = azurerm_public_ip.nat_ip.id
}

resource "azurerm_app_service_virtual_network_swift_connection" "example" {
  app_service_id = azurerm_linux_web_app.app.id
  subnet_id      = azurerm_subnet.snet.id
}

resource "azurerm_public_ip" "nat_ip" {
  name                = "demovk-nat-ip"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  allocation_method   = "Static"
   sku                 = "Standard"
  zones               = ["1"]
}

resource "azurerm_public_ip_prefix" "example" {
  name                = "demovk-publicIPPrefix"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  prefix_length       = 30
  zones               = ["1"]
}

resource "azurerm_linux_web_app" "app" {
  name                = "dmeovkapp"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  service_plan_id     = azurerm_service_plan.asp.id

  site_config {
    vnet_route_all_enabled = true
  }

  identity {
    type = "SystemAssigned"
  }
 
}

字符串

输出：

步数：terraform_apply

的数据