我尝试在keyvault中分配Azure cosmos DB Access策略，并成功传递了从terraform创建的对象ID。
在这里，我尝试创建Cosmos DB帐户，配置如下所述。

Cosmos_db配置
main.tf

resource "azurerm_user_assigned_identity" "example" {
  resource_group_name = "demovk-rg"
  location            = "East US"
  name                = "demovk-resource"
}


resource "azurerm_cosmosdb_account" "example" {
  name                  = "demovkwwvk-resource"
  location              = "East US"
  resource_group_name   = "demovk-rg"
  default_identity_type = join("=", ["UserAssignedIdentity", azurerm_user_assigned_identity.example.id])
  offer_type            = "Standard"
  kind                  = "MongoDB"

  capabilities {
    name = "EnableMongo"
  }

  consistency_policy {
    consistency_level = "Strong"
  }

  geo_location {
    location          = "eastus"
    failover_priority = 0
  }

  identity {
    type         = "SystemAssigned, UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.example.id]
  }

  depends_on = [azurerm_user_assigned_identity.example]
}

output "Object_id" {
    value   = azurerm_cosmosdb_account.example.identity[0].principal_id
}

字符串
使用此配置，我们将能够配置cosmos dB account auto enabled SystemUserIdentityObject_ID。
我们可以在这里看到output的值。

输出：

的数据
&

在下一步中，我们需要配置保险库和访问策略。

main.tf

data "azurerm_key_vault" "example" {
  name                = "vkvkvkkeyvault"
  resource_group_name = "demovk-rg"
}

data "azurerm_client_config" "current" {}

resource "azurerm_key_vault_access_policy" "example-principal" {
  key_vault_id = data.azurerm_key_vault.example.id
  tenant_id    = data.azurerm_client_config.current.tenant_id
  object_id    = azurerm_cosmosdb_account.example.identity[0].principal_id

  key_permissions = [
    "Get",
    "List",
    "Encrypt",
    "Decrypt",
  ]
  depends_on = [azurerm_cosmosdb_account.example]
}

型
这将访问现有的密钥库，并尝试根据要求提供访问策略。

输出：

的
&

的
通过这种配置，我们可以使用terraform调用对象ID，我们不需要硬编码它，我们还可以为cosmosdB创建访问策略。