需要帮助理解terraform代码

Question

我不确定我是否能够完全理解代码，请在这里帮助我。这是我的代码，我不明白Azure Active Directory在这里做什么，vault的目的是什么。

data "vault_generic_secret" "client_id" {
  path = var.settings.client_id
}

data "vault_generic_secret" "client_secret" {
  path = var.settings.client_secret
}

# Display a secret client for Azure Service Principal
output "secret" {
  value = data.vault_generic_secret.client_id.data["client_id"]
}


locals {
  vault_client_id     = data.vault_generic_secret.client_id.data["client_id"]
  vault_client_secret = data.vault_generic_secret.client_secret.data["client_secret"]

  settings_with_secrets = merge(var.settings, {
    client_id     = local.vault_client_id
    client_secret = local.vault_client_secret
  })

}


resource "aws_cognito_identity_provider" "universal_provider" {

  user_pool_id  = var.user_pool_id
  provider_name = var.provider_name
  provider_type = var.provider_type

  provider_details = local.settings_with_secrets

  attribute_mapping = var.attribute_mappings

  # We use this to avoid changes to this every execution as described here: 
  # https://github.com/hashicorp/terraform-provider-aws/issues/4831
  # https://github.com/hashicorp/terraform-provider-aws/issues/4807
  lifecycle {
    ignore_changes = [
      provider_details["attributes_url"],
      provider_details["attributes_url_add_attributes"],
      provider_details["authorize_url"],
      provider_details["token_request_method"],
      provider_details["token_url"],
      provider_details["oidc_issuer"]
    ]
  }

}

Answer 1

AAD在这里什么也不做。

存储库提供程序允许Terraform读取、写入和配置HashiCorp Vault。参考here。

因此，该脚本读取HashiCorp服务主体的客户端id和客户端机密(存储在Azure存储库中)。参考here。

然后将它们作为settings_with_secrets放入locals值中以供以后使用。

最后，通过在provider_details中设置其客户端id和客户端秘密，以AAD作为提供者进行provides a Cognito User Identity Provider resource。