授权和身份验证示例

locals {  tags = {       CreatedBy = "Terraform"       Owner     = var.owner       Module    = "tf-example-oidc-azure"       Name      = var.project_name  }}
resource "azurerm_resource_group" "this" {  name     = var.project_name  location = var.location  tags     = local.tags}
resource "azurerm_virtual_network" "this" {  name                = var.project_name  address_space       = ["10.0.0.0/16"]  location            = azurerm_resource_group.this.location  resource_group_name = azurerm_resource_group.this.name  tags                = local.tags}
resource "azurerm_subnet" "internal" {  name                 = "internal"  resource_group_name  = azurerm_resource_group.this.name  virtual_network_name = azurerm_virtual_network.this.name  address_prefixes     = ["10.0.2.0/24"]}
resource "azurerm_public_ip" "vm-public-ip" {  name                = "public-ip-${var.project_name}"  location            = var.location  resource_group_name = azurerm_resource_group.this.name  allocation_method   = "Dynamic"  domain_name_label   = var.project_name  tags                = local.tags}
resource "azurerm_network_interface" "this" {  name                = "ip-${var.project_name}"  location            = var.location  resource_group_name = azurerm_resource_group.this.name  tags                = local.tags
  ip_configuration {       subnet_id                     = azurerm_subnet.internal.id       name                          = "public"       private_ip_address_allocation = "Dynamic"       public_ip_address_id          = azurerm_public_ip.vm-public-ip.id  }}
resource "azurerm_user_assigned_identity" "this" {  location            = var.location  name                = var.project_name  resource_group_name = azurerm_resource_group.this.name  tags                = local.tags}
resource "azurerm_linux_virtual_machine" "this" {  name                  = var.project_name  resource_group_name   = azurerm_resource_group.this.name  location              = var.location  size                  = "Standard_F2"  admin_username        = var.vm_admin_username  custom_data           = data.cloudinit_config.this.rendered  network_interface_ids = [azurerm_network_interface.this.id]  tags                  = local.tags
  admin_ssh_key {       username   = var.vm_admin_username       public_key = var.ssh_public_key  }
  source_image_reference {       publisher = "Canonical"       offer     = "0001-com-ubuntu-server-jammy"       sku       = "22_04-lts"       version   = "latest"  }
  os_disk {       storage_account_type = "Standard_LRS"       caching              = "ReadWrite"       disk_size_gb         = 30  }
  identity {       type = "UserAssigned"       identity_ids = [azurerm_user_assigned_identity.this.id]  }}

# Azure Variables
variable "token_audience" {  type        = string  default     = "https://management.azure.com/"  description = "Used as resource when getting the access token. See more in the [Azure documentation](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http)"}
# MongoDB Atlas variables
variable "org_id" {  type        = string  description = "MongoDB Atlas Organization ID"}
variable "project_id" {  type        = string  description = "MongoDB Atlas Project ID"}
variable "project_name" {  type        = string  description = "MongoDB Atlas Project Name"}
variable "connection_strings" {  type        = list(string)  description = "MongoDB Atlas Cluster Standard Connection Strings"}

org_id = "32b6e34b3d91647abb20e7b8"project_id = "67212db237c5766221eb6ad9"project_name = "My Project"connection_strings =token_audience = "https://management.azure.com/"

output "vm_fqdn" {  value       = azurerm_public_ip.vm-public-ip.fqdn  description = "Fully Qualified Domain Name (FQDN) of the Virtual Machine (VM)"}
output "ssh_connection_string" {  value       = "ssh ${var.vm_admin_username}@${azurerm_public_ip.vm-public-ip.fqdn}"  description = "Useful for connecting to the instance"}
output "user_test_conn_string" {  value       = "mongodb+srv://${local.test_user_username}:${local.test_user_password}@${replace(mongodbatlas_advanced_cluster.this.connection_strings[0].standard_srv, "mongodb+srv://", "")}/?retryWrites=true"  sensitive   = true  description = "Useful for connecting to the database from Compass or other tool to validate data"}
output "user_oidc_conn_string" {  value       = local.mongodb_oidc_uri  sensitive   = true  description = "Useful to see the format of the OIDC connection string"}