azurerm_monitor_scheduled_query_rules_alert_v2 does not support adx as source

[JuupHietbrink]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.5.7

AzureRM Provider Version

3.72.0

Affected Resource(s)/Data Source(s)

azurerm_monitor_scheduled_query_rules_alert_v2

Terraform Configuration Files

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "log_alert" {
  name                      = "Name"
  display_name              = "Name"
  resource_group_name       = var.resource_group_name
  location                  = var.location
  evaluation_frequency      = "P1D"
  window_duration           = "P1D"
  scopes                    = [data.azurerm_resource_group.rg.id]
  severity                  = 3
  skip_query_validation     = true
  criteria {
    query                   = <<-QUERY
    adx('https://help.kusto.windows.net/Samples').StormEvents
      QUERY
    time_aggregation_method = "Count"
    threshold               = 0
    operator                = "GreaterThan"
    failing_periods {
      minimum_failing_periods_to_trigger_alert = 1
      number_of_evaluation_periods             = 1
    }
  }
  enabled                   = var.action_groups_enabled
  action {
    action_groups           = [azurerm_monitor_action_group.email.id] #[azurerm_monitor_action_group.email.id]
  }
  tags                      = var.tags
}

Debug Output/Panic Output

│ Scheduled Query Rule Name: "Name"): scheduledqueryrules.ScheduledQueryRulesClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure:
│ Service returned an error. Status=400 Code="BadRequest" Message="{\r\n  \"error\": {\r\n    \"message\": \"The request had some invalid properties\",\r\n    \"code\":
│ \"BadArgumentError\",\r\n    \"correlationId\": \"{my_correlation_id}\",\r\n    \"innererror\": {\r\n      \"code\": \"QueryValidationError\",\r\n      \"message\": \"The
│ 'adx' pattern cannot be used with the current authentication scheme\"\r\n    }\r\n  }\r\n}"

Expected Behaviour

I have created the exact same alert in the azure portal with the same adx pattern and that works. I expected terraform to create the same alert rule with this same configuration.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy

Actual Behaviour

No response

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[JuupHietbrink]

FYI: Also azurerm_monitor_scheduled_query_rules_alert does not support the adx as source.
Scheduled Query Rule Name: "Name"): scheduledqueryrules.ScheduledQueryRulesClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="{\r\n "error": {\r\n "message": "The request had some invalid properties",\r\n "code": "BadArgumentError",\r\n "correlationId": "{my_reqeust_id}",\r\n "innererror": {\r\n "code": "QueryValidationError",\r\n "message": "The 'adx' pattern cannot be used with the current authentication scheme"\r\n }\r\n }\r\n}"

[crozzer]

I have also just hit this issue but using an ARM Template. Adding "skipQueryValidation": true, to the properties seemingly makes no difference either as it validates it anyway.

[crozzer]

@JuupHietbrink I have just got my ARM template to work just in case it helps you with you issue. I just needed to add "identity": { "type": "SystemAssigned" },

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.