Bug Report: Azure Policies with Log Analytics Workspace parameters issue

[ofbjansen]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform: 1.0.8

azure provider: 2.88.1

module: 1.1.0

Description

Describe the bug

When deploying any of the policies that use Log Analytics workspace in a parameter the policy is created and all looks fine, but the actual log analytics workspace is not linked to the policy. You will see the log analytics setting in the overview, but when editting the policy you have to manual select the log analytics workspace by hand. After selecting the log analytics workspace you will get that resources are changed outside of terraform.

Steps to Reproduce

1. Deploy module with management resources.
2. Check "Enable Azure Monitor for VM's" Policy assignment.
3. You will find that Parameter ID "LogAnalytics_1" has a parameter value that seems to be reflecting the LAW
4. Edit assignment and go to Parameters.
5. You will find that the Log Analytics workspace is not linked.
6. Link it to the correct log analytics workspace.
7. Run a plan on your code and the plan will give a lot of changes on the assigned policies in the policy sets

Screenshots

Additional context

I have advanced settings to change management resource group name and log analytics workspace name.

This is my results after changing the log analytics parameter in the portal and then run the terraform plan:

-/+ resource "azurerm_management_group_policy_assignment" "enterprise_scale" {
      ~ id                   = "/providers/Microsoft.Management/managementGroups/onno/providers/Microsoft.Authorization/policyAssignments/Deploy-VM-Monitoring" -> (known after apply)
      ~ metadata             = jsonencode(
            {
              - createdBy       = "<replaced>"
              - createdOn       = "2021-12-16T11:23:20.6031504Z"
              - parameterScopes = {
                  - logAnalytics_1 = "/subscriptions/<replaced>/resourcegroups/rg-test"
                }
              - updatedBy       = "<replaced>"
              - updatedOn       = "2021-12-16T11:28:15.7183847Z"
            }
        ) -> (known after apply)
        name                 = "Deploy-VM-Monitoring"
      ~ parameters           = jsonencode(
          ~ {
              ~ logAnalytics_1 = {
                  ~ value = "/subscriptions/<replaced>/resourcegroups/rg-test/providers/microsoft.operationalinsights/workspaces/log-test" -> "/subscriptions/<replaced>/resourceGroups/rg-test/providers/Microsoft.OperationalInsights/workspaces/log-test"
                }
            } # forces replacement
        )
        # (7 unchanged attributes hidden)

      ~ identity {
          ~ principal_id = "<replaced>" -> (known after apply)
          ~ tenant_id    = "<replaced>" -> (known after apply)
            # (1 unchanged attribute hidden)
        }
    }

[matt-FFFFFF]

Hi @ofbjansen,

Thanks for reporting the issue. Can I ask that you try and deploy the policy assignment using only the module, and then run the following command to get the configuration from ARM:

az rest --method GET --uri /providers/Microsoft.Management/managementGroups/onno/providers/Microsoft.Authorization/policyAssignments/Deploy-VM-Monitoring?api-version=2021-06-01

This will show you the JSON representation of the policyAssignment. I am interested to know if we have a portal UI bug here or whether the policy parameter is not configured correctly.

Many thanks!

[ofbjansen]

az rest --method GET --uri /providers/Microsoft.Management/managementGroups/onno/providers/Microsoft.Authorization/policyAssignments/Deploy-VM-Monitoring?api-version=2021-06-01

Hi matt, I get an error back:
no matches found: /providers/Microsoft.Management/managementGroups/onno/providers/Microsoft.Authorization/policyAssignments/Deploy-VM-Monitoring?api-version=2021-06-01

[ofbjansen]

@matt-FFFFFF

Found out that the policy assignments are missing metadata variables. Not yet found the solution in the code (not yet thought about it), but wanted to share what I did in order to make it work in my Sandbox.

In the module changed the policy_assignment_es_deploy_vm_monitoring.tmpl.json file to contain the metadata missing for the policy to work (file location modules/archetypes/lib/policy_assignments/policy_assignment_es_deploy_vm_monitoring.tmpl.json):

code added:

"metadata": {
      "parameterScopes": {
        "logAnalytics_1": "/subscriptions/<subscription_id_removed>/resourcegroups/rg-test"
      }
    },

this additional configuration made it work for the vm monitoring and I guess this is the case on multiple other policies.

Hope this will give you all a nudge in the right direction.

[krowlandson]

@ofbjansen - yes we also believe this to be the solution and are just waiting on the chance to test and confirm. This was on our backlog but low priority as no-one had previously asked for this.

As our policies are sourced from the Azure/Enterprise-Scale, we will have to make the updates there, pull down and then add to the next release.

We will keep you up to date on how this progresses via this issue for now but will probably link to another in the upstream repository once we're ready to start working on this.

Thank you for bringing this to our attention for prioritisation 😄

[matt-FFFFFF]

Hi @ofbjansen

I wanted to clarify that this issue doesn't prevent the policy assignment from working, it only prevents the portal UI from displaying the parameter correctly.

To prove this, I have deployed the module and then performed a GET on the Azure Policy Assignment resource using the following command:

❯ az rest --method GET --uri /providers/Microsoft.Management/managementGroups/issue244/providers/Microsoft.Authorization/policyAssignments/Deploy-VM-Monitoring?api-version=2021-06-01 | jq .properties.parameters

This produces the following output, with the correct resourceId of the Log Analytics Workspace, as you can see:

{
  "logAnalytics_1": {
    "value": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/issue244-mgmt/providers/Microsoft.OperationalInsights/workspaces/issue244-la"
  }
}

I will log an issue in the parent repo to cover this so that we have it on our backlog. However, this may have a low priority as it is a cosmetic bug, rather than a functional one.

[matt-FFFFFF]

Upstream issue: Azure/Enterprise-Scale#882

[matt-FFFFFF]

Closing, will create a separate enhancement issue to track