Terraform data source not able to fetch existing resource

Viewed 750

Unable to get existing resource using Terraform Data source. I am getting below error,

It can run successfully if it is for one storage account.

But what I need to achieve is, for first storage account create Private DNS Zone that is "privatelink.blob.core.windows.net", subsquent storage account use existing Private DNS Zone that is "privatelink.blob.core.windows.net".

For that, I am using lookup variable, if it is true , do not create just look for existing resource, if false create it.

Can somebody please help, what I am doing mistake in below code. All required details shared below. If additional information is required, please do comment.

Error: Private DNS Zone "privatelink.blob.core.windows.net" (Resource Group "rg1") was not found
│
│   with module.storage[1].data.azurerm_private_dns_zone.lookup[0],
│   on ../../../../modules/storage/main.tf line 57, in data "azurerm_private_dns_zone" "lookup":
│   57: data "azurerm_private_dns_zone" "lookup" {

Below is the module main.tf

resource "azurerm_storage_account" "main" {
  name                          = var.storage_name
  resource_group_name           = var.storage_resource_group_name
  location                      = var.storage_location
  account_tier                  = var.account_tier
  account_kind                  = var.account_kind
  account_replication_type      = var.account_replication_type
  enable_https_traffic_only     = var.enable_https_traffic_only
  min_tls_version               = var.min_tls_version
  allow_blob_public_access      = var.allow_blob_public_access
  tags                          = var.tags
  depends_on = [
    azurerm_private_dns_zone.main
  ]
}

resource "azurerm_storage_container" "main" {
  count                 = length(var.container_names)
  name                  = var.container_names[count.index]
  storage_account_name  = azurerm_storage_account.main.name
  container_access_type = var.container_access_type
}

resource "azurerm_storage_account_network_rules" "main" {
  storage_account_id = azurerm_storage_account.main.id

  default_action             = var.default_action
  ip_rules                   = var.ip_rules
  virtual_network_subnet_ids = var.virtual_network_subnet_ids
  bypass                     = var.bypass
}

resource "azurerm_private_endpoint" "main" {
  name                = var.pep_name
  location            = var.pep_location
  resource_group_name = var.pep_resource_group_name
  subnet_id           = var.pep_subnet_id

  private_service_connection {
    name                           = var.psc_name
    private_connection_resource_id = azurerm_storage_account.main.id
    subresource_names              = var.subresource_names
    is_manual_connection           = var.is_manual_connection
  }
  private_dns_zone_group {
       name                  = var.private_dns_group_name
       private_dns_zone_ids  = var.lookup_private_dns_zone_name ? [data.azurerm_private_dns_zone.lookup[0].id] : [azurerm_private_dns_zone.main[0].id]
  }
}

resource "azurerm_private_dns_zone" "main" {
  count               = var.lookup_private_dns_zone_name ? 0 : 1
  name                = var.private_dns_zone_name
  resource_group_name = var.private_dns_zone_resource_group_name
}

data "azurerm_private_dns_zone" "lookup" {
  count               = var.lookup_private_dns_zone_name ? 1 : 0
  name                = azurerm_private_dns_zone.main[0].name
  resource_group_name = azurerm_private_dns_zone.main[0].resource_group_name

  depends_on = [
    azurerm_private_dns_zone.main
  ]
}

resource "azurerm_private_dns_zone_virtual_network_link" "main" {
  name                  = var.private_dns_zone_virtual_network_link_name
  resource_group_name   = var.private_dns_zone_virtual_network_link_resource_group_name
  private_dns_zone_name = var.lookup_private_dns_zone_name ? data.azurerm_private_dns_zone.lookup[0].name : azurerm_private_dns_zone.main[0].name
  virtual_network_id    = var.private_dns_zone_virtual_nevtwork_id
}

calling root module:

module "storage" {
  count                                                     = length(var.storage)
  source                                                    = "../../../../modules/storage"
  storage_name                                              = join("", [local.prefix, "store", var.storage[count.index].id])
  lookup_private_dns_zone_name                              = try(var.storage[count.index].lookup_private_dns_zone_name, false)
  storage_resource_group_name                               = var.storage[count.index].resource_group_name
  storage_location                                          = var.storage[count.index].location
  account_replication_type                                  = try(var.storage[count.index].account_replication_type, "GRS")
  tags                                                      = merge(try(var.storage[count.index].tags, {}), local.tags)
  container_names                                           = try(var.storage[count.index].container_names, [])
  virtual_network_subnet_ids                                = try(var.storage[count.index].virtual_network_subnet_ids, [])
  default_action                                            = try(var.storage[count.index].default_action, "Deny")
  pep_name                                                  = join("", [local.prefix, "pepstore", var.storage[count.index].id])
  pep_location                                              = var.storage[count.index].location
  pep_resource_group_name                                   = var.storage[count.index].resource_group_name
  pep_subnet_id                                             = var.storage[count.index].pep_subnet_id
  psc_name                                                  = join("", [local.prefix, "pscstore", var.storage[count.index].id])
  is_manual_connection                                      = false
  private_dns_group_name                                    = join("", [local.prefix, "dnsgroupstore", var.storage[count.index].id])
  private_dns_zone_name                                     = "privatelink.blob.core.windows.net"
  private_dns_zone_resource_group_name                      = var.storage[count.index].resource_group_name
  private_dns_zone_virtual_network_link_name                = join("", [local.prefix, "pdzvnlstore", var.storage[count.index].id])
  private_dns_zone_virtual_network_link_resource_group_name = var.storage[count.index].resource_group_name
  private_dns_zone_virtual_network_id                       = var.storage[count.index].private_dns_zone_virtual_network_id
  depends_on                                                = [module.resource_group]
}

input file poc.tfvars.json:

{"storage": [
        {
            "id": "04",
            "resource_group_name": "rg1",
            "location": "westus2",
            "pep_subnet_id": "sub_net_resource_id",
            "private_dns_zone_virtual_network_id": "virtual_network_id",
            "container_names": ["containerinfratfswsu2ctedev"]
        },
        {
            "id": "05",
            "lookup_private_dns_zone_name": true,
            "resource_group_name": "WUS2-DEV-PE-CTE-CCI-TF-REPO-RG",
            "location": "westus2",
            "pep_subnet_id": "subnet_resource_id",
            "private_dns_zone_virtual_network_id": "virtual_network_id"
        }
    ]}
1 Answers

Since you are using:

module "storage" {
  count                                                     = length(var.storage)

the two instances of your module will be created concurrently, not in succession. So obviously, second instance of the module fails, because it is created at the same time (not after) the first instance. So at this very moment, there is no azurerm_private_dns_zone.

You either have to run the modules manually, one after the other with depends_on, or somehow extract the lookup_private_dns_zone_name functionality to its own module, that is run before everything else.

Other alternative is to use External Data Source that activates for second instance module, and artificially halts its till the azurerm_private_dns_zone exists. Buts its very hacky to relay on that.

Related