azurerm_monitor_diagnostic_setting中retention_policy已弃用，如何用azurerm_storage_management_policy替代？

由于azurerm_monitor_diagnostic_setting内的retention_policy已被弃用，需改用azurerm_storage_management_policy实现日志保留规则。核心思路是：先让诊断日志输出到指定存储账户，再为该存储账户配置生命周期管理策略，针对对应日志容器设置自动删除过期日志。

完整实现代码 #

# 1. 定义存储账户（若已有可直接复用现有资源）
resource "azurerm_storage_account" "diagnostics" {
  name                     = "diagnosticstoragetest"
  resource_group_name      = azurerm_resource_group.example.name
  location                 = azurerm_resource_group.example.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

# 2. 修改诊断设置：移除retention_policy，添加storage_account_id指定日志存储目标
resource "azurerm_monitor_diagnostic_setting" "example" {
  name                       = "example"
  target_resource_id         = azurerm_linux_web_app.example.id
  log_analytics_workspace_id = var.log_analytics_workspace_id
  storage_account_id         = azurerm_storage_account.diagnostics.id

  log {
    category = "AppServiceHTTPLogs"
    enabled  = true
    # 删除原有的retention_policy配置块
  }
}

# 3. 配置存储账户生命周期管理策略，实现10天日志保留
resource "azurerm_storage_management_policy" "diagnostics_retention" {
  storage_account_id = azurerm_storage_account.diagnostics.id

  rule {
    name    = "appservice-httplogs-retention"
    enabled = true

    filters {
      prefix_match = ["insights-logs-appservicehttplogs"] # 匹配AppServiceHTTPLogs对应的容器前缀
      blob_types   = ["blockBlob"]
    }

    actions {
      base_blob {
        delete_after_days_since_modification_greater_than = 10
      }
    }
  }
}

关键说明 #

• 存储容器命名规则：Azure诊断日志会自动创建以insights-logs-开头的容器，后缀为日志分类名的小写形式，比如AppServiceHTTPLogs对应容器insights-logs-appservicehttplogs
• 策略规则中的prefix_match需精准匹配目标日志容器，确保仅对指定日志类型生效
• 若需管理多个日志分类，可在filters.prefix_match中添加多个前缀，或新增独立rule块分别配置不同保留周期

内容的提问来源于stack exchange，提问作者nkol