azure - 如何解决使用 Terraform 创建计划的 Sentinel 警报规则失败的问题

Question

我正在尝试使用Sentinel 警报自动化规则 和Sentinel 警报规则计划 部署 Microsoft Sentinel 解决方案。我使用服务主体来分配 Microsoft Sentinel Automation Contributor，以便它可以创建具有要运行的 playbook 的自动化规则(此类自动化规则尚未包含在代码中)。但是，当我运行 terraform apply 时，它无法创建计划的警报规则，给出有关找不到工作簿的错误。我还没有使用他们提供的 id 创建工作簿。有人可以解释为什么会发生这种情况以及如何解决吗？

代码:

terraform {}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "rg-sentinel-alert-rule-test"
  location = "eastus2"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "example-workspace"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"

  depends_on = [azurerm_resource_group.example]
}

resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  workspace_id = azurerm_log_analytics_workspace.example.id

  depends_on = [azurerm_log_analytics_workspace.example]
}

data "azuread_service_principal" "security_insight" {
  display_name = "Azure Security Insights"

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.example]
}

resource "azurerm_role_assignment" "sentinel_automation_contributor" {
  scope                = azurerm_resource_group.example.id
  role_definition_name = "Microsoft Sentinel Automation Contributor"
  principal_id         = data.azuread_service_principal.security_insight.object_id

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.example]
}

resource "azurerm_sentinel_alert_rule_scheduled" "example" {
  name                       = "example"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id
  display_name               = "example"
  severity                   = "High"
  query                      = <<QUERY
AzureActivity |
  where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
  where ActivityStatus == "Succeeded" |
  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

  depends_on = [azurerm_sentinel_log_analytics_workspace_onboarding.example]
}

resource "azurerm_sentinel_automation_rule" "example" {
  name                       = "56094f72-ac3f-40e7-a0c0-47bd95f70336"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id
  display_name               = "automation_rule1"
  order                      = 1
  action_incident {
    order  = 1
    status = "Active"
  }

  depends_on = [azurerm_role_assignment.sentinel_automation_contributor]
}

错误:

Error: creating Sentinel Alert Rule Scheduled "Alert Rule (Subscription: \"{my-subscription-id}\"\n
Resource Group Name: \"rg-sentinel-alert-rule-test\"\n
Workspace Name: \"example-workspace\"\nRule: \"example\")":
alertrules.AlertRulesClient#AlertRulesCreateOrUpdate: Failure responding to request:
StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400
Code="BadRequest" Message="Failed to run the analytics rule query. Log Analytics
workspace 'b819562b-650e-4277-9035-c89a1f6d64c5' could not be found."
│ 
│   with azurerm_sentinel_alert_rule_scheduled.example,
│   on main.tf line 41, in resource "azurerm_sentinel_alert_rule_scheduled" "example":
│   41: resource "azurerm_sentinel_alert_rule_scheduled" "example" {
│ 
╵

Answer 1

我正在使用 terraform 提供程序版本 3.40 和

我已经检查了 log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id ，它给出了错误。我正在使用 terraform 版本 3.40:

代码:

resource "azurerm_sentinel_alert_rule_scheduled" "example" {
name = "examplekaalertrule"
log_analytics_workspace_id =  azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id  
display_name = "examplesentielrule"
severity = "High"
query = <<QUERY
AzureActivity |
where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
where ActivityStatus == "Succeeded" |
make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

depends_on = [
  azurerm_sentinel_log_analytics_workspace_onboarding.example
]
}

检查以下对我有用的代码。

代码:

resource "azurerm_log_analytics_workspace" "rgcore-management-la" {
  name                = "la-example-utv-weu"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

resource "azurerm_log_analytics_solution" "example" {
  solution_name         = "SecurityInsights"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  workspace_resource_id = azurerm_log_analytics_workspace.rgcore-management-la.id
  workspace_name        = azurerm_log_analytics_workspace.rgcore-management-la.name
  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/SecurityInsights"
  }
  depends_on = [azurerm_log_analytics_workspace.rgcore-management-la]

}



resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  resource_group_name          = data.azurerm_resource_group.example.name
  workspace_name               = azurerm_log_analytics_workspace.rgcore-management-la.name
  customer_managed_key_enabled = false

}




resource "azurerm_sentinel_alert_rule_scheduled" "example" {
name = "examplekaalertrule"
log_analytics_workspace_id = azurerm_log_analytics_solution.example.workspace_resource_id 
display_name = "examplesentielrule"
severity = "High"
query = <<QUERY
AzureActivity |
where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
where ActivityStatus == "Succeeded" |
make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

depends_on = [
  azurerm_sentinel_log_analytics_workspace_onboarding.example
]
}

使用 terraform 提供程序版本 3.5.0 和 az cli 版本 2.30，即使遵循您提供的代码也可以工作。

resource "azurerm_log_analytics_workspace" "management-la" {
  name                = "example-weu"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  sku                 = "PerGB2018"
  retention_in_days   = 90
}



resource "azurerm_sentinel_log_analytics_workspace_onboarding" "example" {
  workspace_id = azurerm_log_analytics_workspace.management-la.id
}

resource "azurerm_sentinel_alert_rule_scheduled" "example" {
  name                       = "edfgxample"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.example.workspace_id
  display_name               = "exghjample"
  severity                   = "High"
  query                      = <<QUERY
AzureActivity |
  where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
  where ActivityStatus == "Succeeded" |
  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY
}

检查您是否拥有访问 Log Analytics 工作区所需的权限。用于运行代码的 Azure AD 用户或服务主体在 Log Analytics 工作区中具有“贡献者”角色。

还要确保 Log Analytics 工作区是否已删除或销毁。