Identity Block Support for azurerm_monitor_scheduled_query_rules_alert_v2

[ASHR4]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

Microsoft has added the ability to Query Azure Resource Graph from Azure Monitor

Utilising this within a azurerm_monitor_scheduled_query_rules_alert_v2 has caused the following error similar to #23248

The 'adx' pattern cannot be used with the current │ authentication scheme

In #23248 they've mentioned a workaround using ARM and adding a system assigned identity resolved this. Can an identity block be added to this resource to support this new functionality required by MS:

New or Affected Resource(s)/Data Source(s)

azurerm_monitor_scheduled_query_rules_alert_v2

Potential Terraform Configuration

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "example" {
  name                = "example-msqrv2"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  + identity {
    + type = SystemAssigned, UserAssigned, SystemAssigned, UserAssigned
    + identity_ids = []
  + }
}

References

https://techcommunity.microsoft.com/t5/azure-observability-blog/query-azure-resource-graph-from-azure-monitor/ba-p/3918298

#23248

[rcskosir]

@ASHR4 Thank you for taking the time to open this feature request!

[VOVELEE]

This is also required for Quota alerts.
I have to use AzAPI atm to implement these and would be happy to migrate to azurerm :)

[ASHR4]

An update regarding this issue if people are waiting like myself

I attempted to resolve, however, the latest API version the HashiCorp Azure SDK uses was 2021-08-01 which doesn't support managed identities.

The earliest API version that supports managed identities for these alerts is 2022-08-01-preview.

Some other resources use preview API versions so I've raised an issue to get this in so I can try and tackle this :)

[ASHR4]

I have written the code for this, however there is an issue with ARM when assigning a user assigned identity.

ARM claims the account running Terraform does not have sufficient permissions, this also occurs when building via the Azure portal

[altruistcoder]

I am also facing the same problem where I need to attach a system-assigned identity to my alert rule and also a few role assignments to that system-assigned identity but it seems that the resource doesn't provide a way yet to specify a block for defining identity that's going to be attached to the alert rule.

Can anyone please suggest a workaround for it? It would be really helpful.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.