Terraform-provider-azurerm: Additional fields for azurerm_monitor_activity_log_alert "Service Health" alerts

[lewinski]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

It isn't possible to create useful "Service Health" type alerts using Terraform because you cannot provide affected services and regions to be monitored in the activity log. These are needed to replicate the alert that is created by going through the Azure Portal. If these are not provided, your service health alert generates alerts for all services in all regions which is probably not interesting to alert on, since I would guess that most people are only using a subset of services/regions in their applications.

New or Affected Resource(s)

• azurerm_monitor_activity_log_alert

Potential Terraform Configuration

resource "azurerm_monitor_activity_log_alert" "service_health" {
  name                = "example-servicehealthalert"
  resource_group_name = "${azurerm_resource_group.main.name}"
  scopes              = ["${data.azurerm_subscription.current.id}"]
  description         = "Health alerts for specific services and regions."

  criteria {
    category = "Service Health"

    service_health_events = ["Incident", "Maintenance"]

    service_health_regions = [
      "Global",
      "West Europe",
      "East US"
    ]

    service_health_services = [
      "Backup",
      "Load Balancer",
      "Network Infrastructure",
      "Virtual Machines",
      "Virtual Network"
    ]
  }

  action {
    //...
  }
}

service_health_events is an optional array of strings. There are 4 possible values for the strings: Incident, Maintenance, Informational, and ActionRequired. In the Azure Portal, these are represented by three choices in the selection menu: Service issue (Incident), Planned maintenance (Maintenance), and Health advisories (Informational and ActionRequired). When the value is omitted, all types of service health events will be alerted upon by omitting this criteria from the API request.

service_health_regions is an optional array of strings. Each string should be the display name of an Azure location (examples: "East US" or "Australia Central 2") or "Global", which is used for some location-less services. When this value is omitted, all regions of service health events will be alerted upon.

service_health_services is an optional array of strings. Each string should be the display name of an Azure service (examples: "Azure Database for MySQL" or "Key Vault"). It is not obvious where to get this list other than the Azure portal itself, where there are currently 148 services. When this value is omitted, all services will be alerted upon.

Here is some example JSON criteria for the above:

    "condition": {
        "allOf": [
            {
                "field": "category",
                "equals": "ServiceHealth",
                "containsAny": null
            },
            {
                "anyOf": [
                    {
                        "field": "properties.incidentType",
                        "equals": "Incident",
                        "containsAny": null
                    },
                    {
                        "field": "properties.incidentType",
                        "equals": "Maintenance",
                        "containsAny": null
                    }
                ]
            },
            {
                "field": "properties.impactedServices[*].ImpactedRegions[*].RegionName",
                "equals": null,
                "containsAny": [
                    "East US",
                    "West Europe",
                    "Global"
                ]
            },
            {
                "field": "properties.impactedServices[*].ServiceName",
                "equals": null,
                "containsAny": [
                    "Backup",
                    "Load Balancer",
                    "Network Infrastructure",
                    "Virtual Machines",
                    "Virtual Network"
                ]
            }
        ]
    }

References

• #2140
• https://docs.microsoft.com/en-gb/rest/api/monitor/activitylogalerts/createorupdate#activitylogalertleafcondition

[lewinski]

I'm happy to work on this functionality but I want to make sure that the schema makes sense before putting in any more time on it. I also would appreciate any recommendations on whether to attempt validation of the region and service lists and how to go about that if it is be recommended.

This does also kind of beg the question of having the ability to do generic "properties.*" alert queries but that seems like a more complicated design to get correct.

[rohrerb]

+1 - Would be great if we had the additional fields.

[lewinski]

I looked at this more today but it doesn't really seem practical until the SDK has support for these fields. I opened up an issue in the SDK repository to track the need.

[MMalikKhan]

Hi @tombuildsstuff @lewinski , off topic. I am exploring to create Log Signal alerts for application insights logs with a query. I could not find a sample to see if log alert can be done with queries ? Could you please let me know if alerts can be created for app insights logs with specific query ? If yes, then how this can be done.. much appreciate your reply .

[ghost]

Hi, any expectations for the availability of this feature?

[mariojacobo]

I couldn't even get this far, for some reason it's not recognizing the fields. I'm using the exact template that OP posted. Any ideas ? I'm using Terraform v0.12.4

Error: Unsupported argument

  on alerts.tf line 31, in resource "azurerm_monitor_activity_log_alert" "service_health":
  31:     service_health_services = [

An argument named "service_health_services" is not expected here.

[cholmes12]

This feature would be great.

[suman5488]

Hi , Please let me know anyone when this issue will be resolved.
I am unable to add these conditions (specific regions, specific services) in the log alerts

[dhaugli]

This feature would be great, its like theres almost no point of even having the servicehealth category in the log alert if these features are lacking.

[turbut]

Looking forward to this feature. At least adding region would be beneficial.

[Yanunita]

yes!! it is very important :)

[stefan-rapp]

Any updates on that? To add the additional attributes like "_Regions_", etc. would be great.

[al-lac]

Really need this soon. Adding the region alone would be enough for my use case for now.

[elsesiy]

@tombuildsstuff Is anybody actively working on this and do you have an ETA? Right now we have to manually configure those alerts, shell out and use azure cli or similar hacks which is less than ideal.

[MaxiPalle]

Any update on this? Maybe it's already fixed, but haven't yet figured it out ...

[nu11modem]

I also have the need to create complex ResourceHealth alerts. Has there been any progress on this?

[julioas09]

This is indeed still not solved. The workaround I can think of with terraform is sending Activity Log diagnostics to a Log Analytics workspace and then setting up an alert based on a LA query.

[k7faq]

When will this issue get attention? over 18 months with no action. Why can we not have focused alerting? When you deal with environments of multiple products, hundreds of servers spread across multiple regions with many PaaS offerings incorporated this present alert becomes DISTRACTINGLY ANNOYING WITH ALERTS.

Microsoft staff please seek focus to enhance this. I don't understand why the conditional statements leveraged by the ARM template cannot be leveraged here. Is Azure not using focused APIs to support requests regardless of platform/service? I get the suspicion that MSFT is creating unique APIs for ARM, unique APIs for PowerShell, unique APIs for Azure CLI, unique APIs for portal.azure.com. If so, I am failing to see the benefit. Why could a unified API platform not serve all of the interfaces?

[theasphaltworld]

hi, if we just do
criteria {
category = "ServiceHealth"
}
I see from azure portal, no region is ticked, surprise it didn't fail.

so if no region is selected, does that mean it applies to all regions?