☁️ Azure Scheduled Query Rule (Alert v1) Terraform Module

module "minimum" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-minimum"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "GreaterThan", threshold = 3 }
  action   = { action_group = [var.action_group_id] }
}

module "legacy_rule" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-legacy"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "LessThan", threshold = 1 }
  action   = { action_group = [var.action_group_id] }
}

output "read_this_before_relying_on_it" {
  value = {
    superseded         = module.legacy_rule.this_resource_is_superseded_by_the_v2_resource
    webhook_unreliable = module.legacy_rule.custom_webhook_payload_is_the_capability_the_provider_names_as_unreliable
  }
}

# REJECTED at plan time by this module.
module "gap_in_the_data" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-gappy"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = {
    frequency   = 60
    time_window = 30 # shorter than the interval
  }

  trigger = { operator = "GreaterThan", threshold = 3 }
  action  = { action_group = [var.action_group_id] }
}

# Rejected by THE PROVIDER, not by this module.
module "conflicting_mitigation" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-conflict"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "GreaterThan", threshold = 3 }
  action   = { action_group = [var.action_group_id] }

  auto_mitigation_enabled = true
  throttling              = 60 # mutually exclusive with the line above
}

# REJECTED at plan time by this module.
module "notifies_nobody" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-silent"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "GreaterThan", threshold = 3 }

  action = {
    action_group = []
  }
}

module "metric_measurement" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-failed-logins-per-computer"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = <<-QUERY
    SecurityEvent
    | where EventID == 4625
    | summarize AggregatedValue = count() by Computer, bin(TimeGenerated, 5m)
  QUERY

  schedule = { frequency = 5, time_window = 30 }

  trigger = {
    operator  = "GreaterThan"
    threshold = 3

    metric_trigger = {
      metric_trigger_type = "Consecutive"
      operator            = "GreaterThan"
      threshold           = 2
      metric_column       = "Computer"
    }
  }

  action   = { action_group = [var.action_group_id] }
  severity = 2
}

module "equal_operator" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-exactly-zero"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }

  trigger = {
    operator  = "Equal" # not in the documented list for this field
    threshold = 0
  }

  action = { action_group = [var.action_group_id] }
}

# REJECTED at plan time by this module.
module "fractional_threshold" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-fractional"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }

  trigger = {
    operator  = "GreaterThan"
    threshold = 3.5 # type-correct, and rejected
  }

  action = { action_group = [var.action_group_id] }
}

module "severity_demo" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-severity-demo"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "LessThan", threshold = 1 }
  action   = { action_group = [var.action_group_id] }

  severity = 0
}

output "severity_shapes" {
  value = {
    as_this_resource_takes_it = module.severity_demo.severity             # 0
    as_two_siblings_take_it   = module.severity_demo.severity_string_form # "Sev0"
    with_its_meaning          = module.severity_demo.severity_label
  }
}

module "overlapping" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-overlapping"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = {
    frequency   = 5
    time_window = 30 # each run re-reads 6x the interval
  }

  trigger = { operator = "GreaterThan", threshold = 3 }
  action  = { action_group = [var.action_group_id] }
}

output "how_much_overlap" {
  value = {
    factor  = module.overlapping.evaluation_overlap_factor # 6
    overlaps = module.overlapping.evaluations_overlap      # true
  }
}

module "throttled" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-throttled"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "GreaterThan", threshold = 3 }
  action   = { action_group = [var.action_group_id] }

  throttling = 60 # minutes; cannot be combined with auto_mitigation_enabled
}

module "cross_resource" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-cross-resource"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.application_insights_id

  # The query reads a second component as well as its own data source.
  authorized_resource_ids = [var.second_application_insights_id]

  query = <<-QUERY
    let a = requests | where toint(resultCode) >= 500 | extend fail = 1;
    let b = app('appi-secondary').requests | where toint(resultCode) >= 500 | extend fail = 1;
    a | join b on fail | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)
  QUERY

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "GreaterThan", threshold = 3 }
  action   = { action_group = [var.action_group_id] }
}

output "query_reach" {
  value = {
    authorized = module.cross_resource.authorized_resource_ids
    is_cross   = module.cross_resource.cross_resource_query_is_authorized
    cap        = module.cross_resource.authorized_resource_ids_cap_as_of_authoring
  }
}

module "no_aggregated_value" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-no-aggval"
  resource_group_name = var.resource_group_name
  location            = var.location

  data_source_id = var.log_analytics_workspace_id
  query          = "Heartbeat | count" # no AggregatedValue column
  query_type     = "ResultCount"

  schedule = { frequency = 5, time_window = 30 }
  trigger  = { operator = "GreaterThan", threshold = 3 }
  action   = { action_group = [var.action_group_id] }
}

check "resultcount_queries_project_aggregatedvalue" {
  assert {
    condition = !module.no_aggregated_value.query_type_requires_an_aggregatedvalue_column || module.no_aggregated_value.query_text_mentions_aggregatedvalue
    error_message = "query_type is ResultCount, which requires the query to project a numeric AggregatedValue column, and the identifier does not appear in the query text."
  }
}

provider "azurerm" {
  features {}
}

module "observability_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-observability-eastus2"
  location = "eastus2"
  tags     = { workload = "platform", managed_by = "terraform" }
}

module "workspace" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-log-analytics-workspace.git?ref=v1.0.0"

  name                = "law-platform-eastus2"
  location            = module.observability_rg.location
  resource_group_name = module.observability_rg.name
  tags                = { workload = "platform", managed_by = "terraform" }
}

module "oncall" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-action-group.git?ref=v1.0.0"

  name                = "ag-platform-oncall"
  resource_group_name = module.observability_rg.name
  short_name          = "platoncall"
  tags                = { workload = "platform", managed_by = "terraform" }
}

module "heartbeat_missing" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-scheduled-query-rules-alert.git?ref=v1.0.0"

  name                = "sqr-heartbeat-missing"
  resource_group_name = module.observability_rg.name
  location            = module.observability_rg.location

  # The workspace's ARM Resource ID, not the workspace_id GUID the same module also emits.
  data_source_id = module.workspace.id

  query = "Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)"

  schedule = {
    frequency   = 5
    time_window = 5 # non-overlapping: one alert per gap
  }

  trigger = {
    operator  = "LessThan"
    threshold = 1
  }

  action = {
    action_group  = [module.oncall.id]
    email_subject = "Heartbeat missing on the platform workspace"
  }

  severity    = 1
  throttling  = 30
  description = "No heartbeat received in the last five minutes."

  tags = { workload = "platform", managed_by = "terraform" }
}

module "quiet_hours" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-monitor-alert-processing-rule-suppression.git?ref=v1.0.0"

  name                = "apr-platform-quiet-hours"
  resource_group_name = module.observability_rg.name
  scopes              = [module.observability_rg.id]
  tags                = { workload = "platform", managed_by = "terraform" }
}

check "the_alert_can_reach_someone" {
  assert {
    condition     = module.heartbeat_missing.action_group_count > 0
    error_message = "The rule has no action groups, so a fired alert would notify nobody."
  }
}

check "evaluations_do_not_overlap" {
  assert {
    condition     = !module.heartbeat_missing.evaluations_overlap
    error_message = "time_window exceeds frequency, so one gap can raise several alerts. Intended here to be non-overlapping."
  }
}

check "the_data_source_is_a_workspace_or_component" {
  assert {
    condition     = !module.heartbeat_missing.data_source_is_neither_workspace_nor_component
    error_message = "The data source is neither a Log Analytics workspace nor an Application Insights component, so the query very likely has nothing to read."
  }
}

output "alerting_posture" {
  value = {
    rule_id            = module.heartbeat_missing.id
    severity           = module.heartbeat_missing.severity_label
    severity_as_string = module.heartbeat_missing.severity_string_form
    notifies           = module.heartbeat_missing.action_group_count
    overlap_factor     = module.heartbeat_missing.evaluation_overlap_factor
    prefer_v2_for_new  = module.heartbeat_missing.this_resource_is_superseded_by_the_v2_resource
    webhook_caveat     = module.heartbeat_missing.custom_webhook_payload_is_the_capability_the_provider_names_as_unreliable
  }
}

variable "schedule" {
  type = object({
    frequency   = number # minutes, 5-1440
    time_window = number # minutes, 5-2880, must be >= frequency
  })
  # Grouped because the provider documents the ordering rule and enforces nothing.
}

variable "trigger" {
  type = object({
    operator  = string # GreaterThan, GreaterThanOrEqual, LessThan, LessThanOrEqual, Equal
    threshold = number # whole number 0-10000

    metric_trigger = optional(object({
      metric_trigger_type = string           # Consecutive or Total
      operator            = string           # the same five values
      threshold           = number           # whole number 0-10000
      metric_column       = optional(string)
    }))
  })
  # The documented operator list for the outer field omits Equal; the provider accepts it.
}

variable "action" {
  type = object({
    action_group           = set(string)      # at least one Action Group Resource ID
    custom_webhook_payload = optional(string) # valid JSON; see the reliability caveat
    email_subject          = optional(string)
  })
}

variable "severity" {
  type    = number
  default = null
  # 0-4, whole number, 0 most severe. Two siblings in this family take "Sev0" instead.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
  # Go durations here: 30m. Plain minutes in schedule. ISO 8601 on the v2 resource.
}