Feature Request: Attach azurerm_application_insights to a azurerm_app_service

[test-in-prod]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Greetings, this is just a feature request to enable attachment of a azurerm_application_insights to a azurerm_app_service.

Right now, this can only be done via the portal (or assuming also via Azure ARM template) by going to an App Service -> Application Insights, then creating or selecting an existing resource. After this, I see it creates APPINSIGHTS_* environment variables (app settings) and also a peculiar "hidden" tag on the target application insights resource with a value "hidden-link:/subscriptions/<subscription id>/resourceGroups/<rg name>/providers/Microsoft.Web/sites/<site name>": "Resource"

I tried to replicate this via terraform, however it does not appear to be working even though the resulting exported ARM template is exactly the same as one generated manually via Azure Portal.

Thanks!

[tombuildsstuff]

hey @CryptonZylog

Thanks for opening this issue :)

Would it be possible to show the Terraform Configuration that you've attempted to use? From what I can see above it should be possible to set a tag on the azurerm_application_insights resource for:

resource "azurerm_application_insights" "test" {
  tags {
    "hidden-link:/subscriptions/<subscription id>/resourceGroups/<rg name>/providers/Microsoft.Web/sites/<site name>": "Resource"
  }
}

Thanks!

[test-in-prod]

Actually, you got it. That's what I've tried anyway (setting that tag).

[tombuildsstuff]

@CryptonZylog

Actually, you got it. That's what I've tried anyway (setting that tag).

👍 as far as I'm aware there's no API for this at the moment - but I've reached out to Microsoft to confirm :)

[Phydeauxman]

I am not sure I understand what the Terraform integration of App Insights is buying us right now. I have created an AI instance and stored its key as an output. When I create an App I want to attach to the AI instance, I add the app_settings section like below:

  app_settings {
    "APPINSIGHTS_INSTRUMENTATIONKEY" = "${data.terraform_remote_state.rg.app_insights_key}"
    "APPINSIGHTS_JAVASCRIPT_ENABLED" = true
  }

These two settings get added to my app but I am not sure what the first one even does because I still have to go into the portal, select Web App > Application Insights and enable it by selecting the recently created AI instance that was created by Terraform. When I do this, I do not see any additional app settings on the Web App. Where would I go to see the hidden tag mentioned above?

[tombuildsstuff]

@Phydeauxman unfortunately the hidden tag needs to be applied on the azurerm_application_insights resource from that to whatever Application Insights should be connected too (e.g. a Web App) - which isn't really a great UX. That said - it should be possible using that approach alone (rather than having to go into the portal).

I've requested that Microsoft investigate adding an API for attaching/detaching Application Insights to things rather than use tags - so it's possible to make this attachment independently; but I'm unsure of the status of that feature request, unfortunately.

[Phydeauxman]

@tombuildsstuff so, I would use the property below under my azurerm_application_insights resource?

resource "azurerm_application_insights" "test" {
  tags {
    "hidden-link:/subscriptions/<subscription id>/resourceGroups/<rg name>/providers/Microsoft.Web/sites/<site name>": "Resource"
  }
}

I am assuming I can use variables in that hidden-link string...right?

[Ruankr]

So I've just completed a project where we are doing this using terraform. The way I accomplish this is as below:

Create Application Insights resource

resource "azurerm_application_insights" "webappai" {
name = "$webappname-wa-ai"
location = "North Europe"
resource_group_name = "${azurerm_resource_group.rg.name}"
application_type = "Web"
}

output "webapp_key" {
value = "${azurerm_application_insights.webappai.instrumentation_key}"
}

output "webapp_id" {
value = "${azurerm_application_insights.webappai.app_id}"
}

Create Webapp

resource "azurerm_app_service" "webapp" {
name = "webappname-wa"
location = "${azurerm_resource_group.rg.location}"
resource_group_name = "${azurerm_resource_group.rg.name}"
app_service_plan_id = "${azurerm_app_service_plan.webappsp.id}"
https_only = "true"

site_config {
dotnet_framework_version = "v4.0"
scm_type = "None"
always_on = "true"
use_32_bit_worker_process = "true"
default_documents = [
"Default.htm",
]
}

app_settings {
"APPINSIGHTS_INSTRUMENTATIONKEY" = "${azurerm_application_insights.webappai.instrumentation_key}"
"APPINSIGHTS_PORTALINFO" = "ASP.NET"
"APPINSIGHTS_PROFILERFEATURE_VERSION" = "1.0.0"
"DIAGNOSTICS_AZUREBLOBCONTAINERSASURL" = "${var.logstore}"
"DIAGNOSTICS_AZUREBLOBRETENTIONINDAYS" = "35"
"WEBSITE_HTTPLOGGING_RETENTION_DAYS" = "35"
}

depends_on = [
"azurerm_app_service_plan.webappsp",
"azurerm_application_insights.webappai"
]
}

The only catch in above is "${var.logstore}" needs to be specified before. I do this by means of a copied connection string of a previously working App Insights. Also, the above does not install the Application Insights extension for the app (webapp) so I take care of this after using a local-exec powershell script.

Hope this helps?

[drdamour]

did they ever come back with an api for this? the docs are still having you modify everything with app settings, seems like most the gui is a thin layer on top of that https://docs.microsoft.com/en-us/azure/azure-monitor/app/azure-web-apps#automate-monitoring

would it fit in terraform to have the options in their own stanza, but in the end they just end up being appsettings? or is that a no-no cause it would cause conflicts with app settings

[drdamour]

@test-in-prod where did you see that hidden tag? in resource explorer?

[drdamour]

i might be missing it, but i don't see that tag anymore. maybe they stopped using it. It appears the only thing that triggers the Portal GUI to show app insights is needed is if the app has various settings on the slot. Here's what i ended up doc'ing

    # Note: per https://github.com/terraform-providers/terraform-provider-azurerm/issues/1440 terraform has no direct control of making these deployment slot settings or not, but luckily the default is
    # to mark them as deployment slot and that's what we want for these. see https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots#which-settings-are-swapped as to why

    # This is a master setting that links the app to the monitor. It also controls the Azure Portals GUI to show insights options in app services.
    "APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.<your insight name>.instrumentation_key

    # This is another master setting. Insights works behind the scenes as a https://www.siteextensions.net/ which just transform the IIS config or the most part
    # it apparently started as an extension and they turned it into a first class gui concept, but behind the scenes it's still an extension, however it does
    # not appear as an extension in your sites extension list.
    # the possible values appear to be ~2 and disabled (though one day someone shoud try ~1 for fun).
    "ApplicationInsightsAgent_EXTENSION_VERSION" = "~2"

    # values are default or recommended. for .net core default is actually disabled and insights will get no data. recommedned starts tracking basic stuff.
    "XDT_MicrosoftApplicationInsights_Mode"= "recommended"

    # There are 3 functions we can turn on for insights beyond basic monitoring in .net
    # Profiler - Collect profiling traces that help you see where time is spent in code. - https://go.microsoft.com/fwlink/?linkid=869613
    # Snapshot Debugger - Collect call stacks for your application when an exception is thrown. (w/ option to turn on local variables) - https://go.microsoft.com/fwlink/?linkid=869614
    # SQL Commands - Enable dependency tracking to show compiled SQL command and local variables in a web request.
    #
    # Depending on what you want on you need to flip sets of various values. Some collide, each are doc'd below.


    # values are disabled or 1.0.0
    # must be 1.0.0 to enable the profiler
    "APPINSIGHTS_PROFILERFEATURE_VERSION" = "1.0.0"

    # values are disabled or ~3
    # must be ~3 to enable the profiler or snapshot debugger
    "DiagnosticServices_EXTENSION_VERSION" = "~3"

    # values are disabled or 1.0.0
    # must be 1.0.0 to enable Snapshot Debugger
    "APPINSIGHTS_SNAPSHOTFEATURE_VERSION" = "1.0.0"

    # values are disabled or ~1
    # must be ~1 to enable local variables in snapshot debugger
    "SnapshotDebugger_EXTENSION_VERSION" = "~1"

    # values are disabled or ~1
    # must be ~1 to enable SQL Commands or local variables in snapshot debugger
    "InstrumentationEngine_EXTENSION_VERSION" = "~1"

    # values are disabled or ~1
    # must be ~1 forto enable SQL Commands
    "XDT_MicrosoftApplicationInsights_BaseExtensions" = "~1"

    # TODO: it's not clear what this does yet.   https://docs.microsoft.com/en-us/azure/azure-monitor/app/azure-web-apps#enable-client-side-monitoring-for-net-core-applications indicates it's not required
    # however i am not seeing any scripts added to the client output for index.html...i'm wondering if it must be a cshtml page to have the monitoring script injected. for now we'll keep it commented
    #"APPINSIGHTS_JAVASCRIPT_ENABLED" = "false"

[phekmat]

would it fit in terraform to have the options in their own stanza, but in the end they just end up being appsettings? or is that a no-no cause it would cause conflicts with app settings

fwiw, this is similar to how the log configuration settings work. The app settings generated by the API are ignored by the provider (though I'm not sure if there's a separate API yet for app insights).

[Marcus-James-Adams]

with MS now contributing to the azurerm provider is there any plan to resolve this issue.
it seems to be common amongst a number of resources now that you can create the resource, create the application insights but can't link them togeather.

[sonic1981]

Not sure if this has changed in the Ms side but it now seems to add a app_settings when you enable App insights, something along the lines of:

"APPLICATIONINSIGHTS_CONNECTION_STRING"      = "InstrumentationKey=<guid>;IngestionEndpoint=https://uksouth-0.in.applicationinsights.azure.com/

[sonic1981]

So it seems setting this value hooks up app insights correctly now. This is what I did:

APPINSIGHTS_INSTRUMENTATIONKEY  = var.appinsight.instrumentation_key
    APPLICATIONINSIGHTS_CONNECTION_STRING         = "InstrumentationKey=${azurerm_application_insights.appinsight.instrumentation_key};IngestionEndpoint=https://${azurerm_resource_group.rg.location}-0.in.applicationinsights.azure.com/"
    WEBSITE_RUN_FROM_PACKAGE                      = ""
    FUNCTIONS_WORKER_RUNTIME                      = "dotnet"
    "ApplicationInsightsAgent_EXTENSION_VERSION"  = "~2"

not too sure about the IngestionEndpoint bit but ti seems to work for now...

[joaocpribeiro]

@sonic1981 Your solution helped me, but the ingestion endpoint has "-1" instead for me (westeurope). I do not know where this number comes from.

[jackofallops]

Closing as appears to be resolved by 8699 but wasn't linked successfully to this issue.

[ghost]

This has been released in version 2.31.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.31.0"
}
# ... other configuration ...

[drdamour]

@jackofallops isn't this request for more native support, IE an app_insights attribute or more likely block within app_service? so we do NOT have to hack through the property namings? in such a case this should stay open i'd think

[Marcus-James-Adams]

I agree This needs to be fully integrated as config

…

On Thu, 8 Oct 2020, 20:15 drdamour, ***@***.***> wrote: @jackofallops <https://github.com/jackofallops> isn't this request for more native support, IE an app_insights attribute or more likely block within app_service? so we do NOT have to hack through the property namings? in such a case this should stay open i'd think — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1303 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AH7GYFZDCUPIL32HUSN7XM3SJYFVXANCNFSM4FB2CX2Q> .

[AdamCoulterOz]

@drdamour / @Marcus-James-Adams / @bkaid - if that's what you want then go tell Microsoft, it is them, not the resource provider who implement connecting the connection in this way (using app settings). Terraform's Azure provider just follows the Azure APIs. The change made to resolve this to make it nicer is the following:

What used to be this:

resource "azurerm_app_service" "example" {

    # ....

    app_settings {
        APPINSIGHTS_INSTRUMENTATIONKEY = azurerm_application_insights.appinsight.instrumentation_key
        APPLICATIONINSIGHTS_CONNECTION_STRING = "InstrumentationKey=${azurerm_application_insights.appinsight.instrumentation_key};IngestionEndpoint=https://${azurerm_resource_group.rg.location}-0.in.applicationinsights.azure.com/"
    }
}

is now this:

resource "azurerm_app_service" "example" {

    # ....

    app_settings {
        APPINSIGHTS_INSTRUMENTATIONKEY = azurerm_application_insights.appinsight.instrumentation_key
        APPLICATIONINSIGHTS_CONNECTION_STRING = azurerm_application_insights.appinsight.connection_string
    }
}

Which imo is much better than it was, and is exactly native.

[Ruankr]

Attaching application insights to a webapp works as expected using the app settings for instrumentation key and connection string.

Oddly though for function apps the same approach does not work. When attached using the portal it adds a hidden tag to the app insights resource.

Running terraform removes the hidden tag, therefore disconnecting the two, so I've tried adding the tag to the app insights resource code using the ID output from the function app.

This however causes a race condition in terraform as the function app needs the app insights resource to get the instrumentation key and connection string, and the app insights resource now needs the function app for the app ID, and terraform can't cope with this.

[drdamour]

@CyanMass45 whats the tag

[Ruankr]

@CyanMass45 whats the tag
@drdamour
"hidden-link:/subscriptions/<subscription id>/resourceGroups/<rg name>/providers/Microsoft.Web/sites/<site name>": "Resource"

[AdamCoulterOz]

does the hidden tag actually break it? I don't think it does... and it would seem to create a circular dependency if you were to make it yourself... my way around it is to deterministically calculate what the resource_id will be after the other side is created and create the hidden-link tag using terraform also, then it won't remove it next time you apply it. Again, this is a circular dependency introduced by Microsoft and not the terraform providers fault.

[drdamour]

@drdamour / @Marcus-James-Adams / @bkaid - if that's what you want then go tell Microsoft, it is them, not the resource provider who implement connecting the connection in this way (using app settings). Terraform's Azure provider just follows the Azure APIs. The change made to resolve this to make it nicer is the following:

What used to be this:

resource "azurerm_app_service" "example" {

    # ....

    app_settings {
        APPINSIGHTS_INSTRUMENTATIONKEY = azurerm_application_insights.appinsight.instrumentation_key
        APPLICATIONINSIGHTS_CONNECTION_STRING = "InstrumentationKey=${azurerm_application_insights.appinsight.instrumentation_key};IngestionEndpoint=https://${azurerm_resource_group.rg.location}-0.in.applicationinsights.azure.com/"
    }
}

is now this:

resource "azurerm_app_service" "example" {

    # ....

    app_settings {
        APPINSIGHTS_INSTRUMENTATIONKEY = azurerm_application_insights.appinsight.instrumentation_key
        APPLICATIONINSIGHTS_CONNECTION_STRING = azurerm_application_insights.appinsight.connection_string
    }
}

Which imo is much better than it was, and is exactly native.

i didn't realize that terraform azurerm provide was against making these types of abstractions. consider me learned.

this issue which is over 2 years old wasn't just about this connectionstring property which just showed up recently so the closure reason seemed not to be compatible with the request.

I've requested that Microsoft investigate adding an API for attaching/detaching Application Insights to things rather than use tags - so it's possible to make this attachment independently; but I'm unsure of the status of that feature request,

given that thought the request was already in progress.

[nickstw]

does the hidden tag actually break it? I don't think it does... and it would seem to create a circular dependency if you were to make it yourself... my way around it is to deterministically calculate what the resource_id will be after the other side is created and create the hidden-link tag using terraform also, then it won't remove it next time you apply it. Again, this is a circular dependency introduced by Microsoft and not the terraform providers fault.

So is there a way to get Application Insights and a Function App to attach using Terraform?

[BradAF]

@nickstw

So is there a way to get Application Insights and a Function App to attach using Terraform?

I got it to work by doing the following to avoid the 'cycle':

1. Define the function name in a local variable
2. Configure APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING in the function apps app_settings

Example snippet:

locals {
  function_app_name     = "func-${local.system_name}-${var.environment}"
}

resource "azurerm_function_app" "func01" {
  name = local.function_app_name
  ...
  
  app_settings = {   
    APPINSIGHTS_INSTRUMENTATIONKEY        = azurerm_application_insights.ai01.instrumentation_key
    APPLICATIONINSIGHTS_CONNECTION_STRING = azurerm_application_insights.ai01.connection_string
  }
}

resource "azurerm_application_insights" "ai01" {
  ...
  
  tags = {
    "hidden-link:/subscriptions/${data.azurerm_subscription.current.subscription_id}/resourceGroups/${azurerm_resource_group.all.name}/providers/Microsoft.Web/sites/${local.function_app_name}" = "Resource"
  }

}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!