授权和身份验证示例

locals {
  tags = {
       CreatedBy = "Terraform"
       Owner     = var.owner
       Module    = "tf-example-oidc-azure"
       Name      = var.project_name
  }
}
resource "azurerm_resource_group" "this" {
  name     = var.project_name
  location = var.location
  tags     = local.tags
}
resource "azurerm_virtual_network" "this" {
  name                = var.project_name
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  tags                = local.tags
}
resource "azurerm_subnet" "internal" {
  name                 = "internal"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = ["10.0.2.0/24"]
}
resource "azurerm_public_ip" "vm-public-ip" {
  name                = "public-ip-${var.project_name}"
  location            = var.location
  resource_group_name = azurerm_resource_group.this.name
  allocation_method   = "Dynamic"
  domain_name_label   = var.project_name
  tags                = local.tags
}
resource "azurerm_network_interface" "this" {
  name                = "ip-${var.project_name}"
  location            = var.location
  resource_group_name = azurerm_resource_group.this.name
  tags                = local.tags
  ip_configuration {
       subnet_id                     = azurerm_subnet.internal.id
       name                          = "public"
       private_ip_address_allocation = "Dynamic"
       public_ip_address_id          = azurerm_public_ip.vm-public-ip.id
  }
}
resource "azurerm_user_assigned_identity" "this" {
  location            = var.location
  name                = var.project_name
  resource_group_name = azurerm_resource_group.this.name
  tags                = local.tags
}
resource "azurerm_linux_virtual_machine" "this" {
  name                  = var.project_name
  resource_group_name   = azurerm_resource_group.this.name
  location              = var.location
  size                  = "Standard_F2"
  admin_username        = var.vm_admin_username
  custom_data           = data.cloudinit_config.this.rendered
  network_interface_ids = [azurerm_network_interface.this.id]
  tags                  = local.tags
  admin_ssh_key {
       username   = var.vm_admin_username
       public_key = var.ssh_public_key
  }
  source_image_reference {
       publisher = "Canonical"
       offer     = "0001-com-ubuntu-server-jammy"
       sku       = "22_04-lts"
       version   = "latest"
  }
  os_disk {
       storage_account_type = "Standard_LRS"
       caching              = "ReadWrite"
       disk_size_gb         = 30
  }
  identity {
       type = "UserAssigned"
       identity_ids = [azurerm_user_assigned_identity.this.id]
  }
}

# Azure Variables
variable "token_audience" {
  type        = string
  default     = "https://management.azure.com/"
  description = "Used as resource when getting the access token. See more in the [Azure documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http)"
}
# MongoDB Atlas variables
variable "org_id" {
  type        = string
  description = "MongoDB Atlas Organization ID"
}
variable "project_id" {
  type        = string
  description = "MongoDB Atlas Project ID"
}
variable "project_name" {
  type        = string
  description = "MongoDB Atlas Project Name"
}
variable "connection_strings" {
  type        = list(string)
  description = "MongoDB Atlas Cluster Standard Connection Strings"
}

org_id = "32b6e34b3d91647abb20e7b8"
project_id = "67212db237c5766221eb6ad9"
project_name = "My Project"
connection_strings =
token_audience = "https://management.azure.com/"

output "vm_fqdn" {
  value       = azurerm_public_ip.vm-public-ip.fqdn
  description = "Fully Qualified Domain Name (FQDN) of the Virtual Machine (VM)"
}
output "ssh_connection_string" {
  value       = "ssh ${var.vm_admin_username}@${azurerm_public_ip.vm-public-ip.fqdn}"
  description = "Useful for connecting to the instance"
}
output "user_test_conn_string" {
  value       = "mongodb+srv://${local.test_user_username}:${local.test_user_password}@${replace(mongodbatlas_advanced_cluster.this.connection_strings[0].standard_srv, "mongodb+srv://", "")}/?retryWrites=true"
  sensitive   = true
  description = "Useful for connecting to the database from Compass or other tool to validate data"
}
output "user_oidc_conn_string" {
  value       = local.mongodb_oidc_uri
  sensitive   = true
  description = "Useful to see the format of the OIDC connection string"
}