如何通过Terraform在Azure APIM所有API级别启用Azure Monitor

需要通过Terraform启用Azure API Management（APIM）中「所有API」层级的Azure Monitor功能，对应控制台操作路径为「所有API」→「设置」页签配置。但目前无法找到正确实现方式，Terraform文档明确支持Application Insights与Azure Monitor，但始终无法完成Azure Monitor的配置。使用官方示例脚本时，terraform plan偶尔成功但terraform apply从未成功，相关脚本如下：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}
 
provider "azurerm" {
  features {}
}
 
locals {
  api_names = ["api1-name","echo-api"]
}
 
data "azurerm_api_management" "api_name" {
  name                = "demo-test-1"
  resource_group_name = "az104"
}
 
data "azurerm_log_analytics_workspace" "log_analytics" {
  name                = "demo-test-23"
  resource_group_name = "az104"
}
 
resource "azurerm_application_insights" "api-insight" {
  name                = "api-appinsights-123"
  location            = data.azurerm_api_management.api_name.location
  resource_group_name = data.azurerm_api_management.api_name.resource_group_name
  application_type    = "web"
}
 
resource "azurerm_api_management_logger" "example" {
  name                  = "demo-test-1-logger"  # Provide a unique name for your logger
  api_management_name = "demo-test-1"
  resource_group_name = "az104"
 
 
  application_insights {
    instrumentation_key = azurerm_application_insights.api-insight.instrumentation_key
 
  }
}
 
data "azurerm_api_management_api" "apis" {
  for_each             = toset(local.api_names)
  resource_group_name  = data.azurerm_api_management.api_name.resource_group_name
  api_management_name  = data.azurerm_api_management.api_name.name
  name                 = each.key
  revision = "1"
}
 
resource "azurerm_api_management_api_diagnostic" "allapis" {
  for_each                 = data.azurerm_api_management_api.apis
 
  identifier               = "azuremonitor"
  resource_group_name      = data.azurerm_api_management_api.apis[each.key].resource_group_name
  api_management_name      = data.azurerm_api_management_api.apis[each.key].api_management_name
  api_name                 = each.key
  api_management_logger_id = azurerm_api_management_logger.example.id
  sampling_percentage      = 100.0
  always_log_errors        = false
  log_client_ip            = true
  verbosity                = "information"
 
  frontend_request {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Origin",
      "Authorization",
      "User-Agent"
    ]
  }
 
  frontend_response {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Origin",
      "Authorization",
      "User-Agent"
    ]
  }
 
  backend_request {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Authorization",
      "User-Agent"
    ]
  }
 
  backend_response {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Authorization",
      "User-Agent"
    ]
  }
 
#   lifecycle {
#     ignore_changes = [operation_name_format]
#   }
}
 
resource "azurerm_monitor_diagnostic_setting" "existing" {
  name                    = "azuremonitor-12"
  target_resource_id      = data.azurerm_api_management.api_name.id
  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.log_analytics.id
 
  enabled_log {
    category = "GatewayLogs"
  }
 
  enabled_log {
    category = "WebSocketConnectionLogs"
  }
 
  enabled_log {
    category = "DeveloperPortalAuditLogs"
  }
 
  metric {
    category = "AllMetrics"
    enabled  = true
  }
}
 
output "apim_id" {
  value = data.azurerm_api_management.api_name.id
}
 
output "log_analytics_id" {
  value = data.azurerm_log_analytics_workspace.log_analytics.id
}

问题分析与解决思路 #

1. 「所有API」层级配置的核心误解 #

当前脚本使用azurerm_api_management_api_diagnostic给单个API配置诊断，但「所有API」层级的配置对应APIM的全局诊断设置，需使用azurerm_api_management_diagnostic资源（而非针对单API的api_diagnostic）实现。

2. 两种监控方式的边界区分 #

脚本同时混用了两类监控配置，需明确需求：

• azurerm_monitor_diagnostic_setting：针对APIM实例本身的运维日志/指标，发送到Log Analytics，属于实例级监控；
• azurerm_api_management_diagnostic（全局）：针对所有API的请求/响应流量日志，发送到Application Insights，属于API流量级监控，对应控制台「所有API」→「设置」的配置。

3. 脚本修正要点 #

替换单API诊断为全局诊断

删除原有azurerm_api_management_api_diagnostic资源，改用全局诊断资源：

resource "azurerm_api_management_diagnostic" "global_all_api" {
  name                  = "azuremonitor"
  api_management_name   = data.azurerm_api_management.api_name.name
  resource_group_name   = data.azurerm_api_management.api_name.resource_group_name
  api_management_logger_id = azurerm_api_management_logger.example.id
  sampling_percentage   = 100.0
  always_log_errors     = false
  log_client_ip         = true
  verbosity             = "information"

  frontend_request {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Origin",
      "Authorization",
      "User-Agent"
    ]
  }

  frontend_response {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Origin",
      "Authorization",
      "User-Agent"
    ]
  }

  backend_request {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Authorization",
      "User-Agent"
    ]
  }

  backend_response {
    body_bytes = 32
    headers_to_log = [
      "X-Request-Id",
      "Authorization",
      "User-Agent"
    ]
  }
}

修复硬编码与依赖问题

• 修正azurerm_api_management_logger的资源引用，避免硬编码：

resource "azurerm_api_management_logger" "example" {
  name                  = "demo-test-1-logger"
  api_management_name   = data.azurerm_api_management.api_name.name
  resource_group_name   = data.azurerm_api_management.api_name.resource_group_name

  application_insights {
    instrumentation_key = azurerm_application_insights.api-insight.instrumentation_key
  }
}

• 添加依赖声明确保资源创建顺序：在azurerm_api_management_diagnostic中加入depends_on = [azurerm_api_management_logger.example]，避免因logger未创建完成导致的报错。

4. apply失败的常见排查方向 #

• 权限不足：确认Terraform使用的服务主体拥有Microsoft.ApiManagement/service/diagnostics/write和Microsoft.Insights/diagnosticSettings/write权限；
• 配置冲突：若APIM控制台已手动配置过「所有API」的诊断，需先删除手动配置，避免Terraform与手动配置冲突；
• 版本兼容性：指定azurerm为3.x稳定版（如3.70.0），避免版本迭代带来的API兼容性问题；
• 资源存在性验证：确保data.azurerm_api_management_api.apis中指定的API名称和版本在APIM实例中真实存在。

5. 验证配置 #

• 执行terraform plan确认资源变更符合预期；
• apply成功后，登录APIM控制台进入「所有API」→「设置」→「诊断」，确认配置已同步；
• 在Application Insights中查看是否有API流量日志生成，或在Log Analytics中查询ApiManagementGatewayLogs验证数据。

内容的提问来源于stack exchange，提问作者Obaidur Rahman Syed