I have just finished working on a few large Terraform Azure deployments, thought I would stick a few notes down in a blog post so that I can refer to them in the future as well as hopefully being useful to others.
Azure Diagnostic Settings
While the azurerm_monitor_diagnostic_setting resource can be used to apply diagnostic settings to pretty much any other resource, however, as each resource has different logs
and metrics
figuring them out can be a chore. This is where the azurerm_monitor_diagnostic_categories
data source comes in.
The azurerm_monitor_diagnostic_categories data source can be used to target an existing resource to gather information on the logs
and metrics
which need to be applied, you can then take this data and apply to a dynamic block in your azurerm_monitor_diagnostic_setting resource. Let’s look at how this would work for a virtual network.
The code below will create a Resource Group, launch a Log Analytics Workspace and also create a Virtual Network:
Now that the resources have been defined, we can grab the information on what logs
and metrics
we need to be enable on the Virtual Network itself by passing the azurerm_monitor_diagnostic_categories data source the ID of our virtual network:
Finally, we can take the information gathered above and apply it using two dynamic blocks, one for the log
and other for the metric
:
In the case of the Virtual Network there are just a single output for each type of diagnostic setting,
Now while this may seem a little overkill, some resources can have up to half a dozen different diagnostic settings so taking approach means you don’t have to really care what they are as they will just be applied.
Expiry Dates
The next thing isn’t really anything to do with Azure - but is useful when you need to set an expiry date - in my case I have been using for setting the expiration date for Azure Virtual Desktop host pool tokens.
Let’s look at an example first:
This will give the following output:
While the above is a really basic example, using it for something like a azurerm_virtual_desktop_host_pool resource would look something like:
You can then take the token generated above and add it to an Azure Key Vault using azurerm_key_vault_secret :
Azure Automation Account Web Hook
Next up we have what was the bane of my life for a good few days, Azure Automation Accounts. While they are supported by the Terraform Azure provider there are some notable omissions - the creation of Webhooks is one.
Before we look at creating the web hook we are going to need an Automation Account and Runbook, the following code adds these with a really basic configuration:
You maybe thinking to yourself, if Terraform doesn’t support web hooks then how can we add them? Luckily Terraform allows you execute ARM templates - which does support the create and assignment of a web hook, there are a few things we are going to have generate first before run the ARM template though.
webhook_expiry_time
= you must assign an expiry date to a webhook, luckily we have just covered how to do that so we will be using that.webhook_token1
andwebhook_token2
= these are two random strings which will go to make up part of the webhook URL
Next we need to create the webook URL itself as this is not done for us, to do this I am setting a local variable so I can reuse it if needed:
As you can see, this using as much dynamically generated content as possible to full in gaps of the URL.
Warning
Please note: As I am am launching my resources in UK South the short location for this is uks, depending on the location you are using you may have alter the code above to change the number of characters being used or hardcode the short region ID.
Now that we have everything needed to generate the URL we can deploy the ARM template by using:
This gives the following output:
All of which means that the following command, updating it to matech your URL, can be used to trigger the web hook:
curl -H 'Content-Length: 0' -X POST 'https://e833b5e7-ef20-41ad-83db-eec633b9d22b.webhook.uks.azure-automation.net/webhooks?token=%2buXamOQWrjJ%2bmzhBt7kpeMKcX5R8wnULaj7zNWBCyh2%3d'
This should return some JSON with the job ID:
|
|
Full Example Code
The full example code to accompany this post can be found at russmckendrick/some-terraform-azure-notes on GitHub .