Terraform更新Azure Alert属性后Action Group触发异常求助

通过Terraform创建Azure告警（Alert）、动作组（Action Group）与逻辑应用（Logic App），初始状态下告警触发时可正常触发Logic App动作。后续调整告警的阈值与窗口时长，修改Terraform代码后执行terraform plan/apply，阈值和窗口时长按预期变更，但更新后告警触发时动作组中的Logic App动作失效。测试确认告警本身正常（邮件通知可正常接收），通过Azure门户删除并重新添加Logic App接收器后动作恢复正常，现需解决如何通过Terraform处理该场景。

初始Terraform代码（Code-1） #

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "myvm_task_alert_v2" {
  name                = "myvm-auto-deletion-alert"
  resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
  evaluation_frequency = "PT1H"
  window_duration      = "PT1H"
  scopes               = [data.azurerm_log_analytics_workspace.azurerm_log_analytics_workspace.id]

  severity             = 4
  criteria {
    query                   = <<-QUERY
        Perf
        | where TimeGenerated > ago(1h)
        | where CounterName == "% Processor Time" and InstanceName == "_Total" 
        | project TimeGenerated, Computer, CounterValue, _ResourceId
        | summarize AggregatedValue = avg(CounterValue)  by bin(TimeGenerated, 1h), Computer, _ResourceId   
      QUERY
    time_aggregation_method = "Maximum"
    threshold               = 30.0
    operator                = "LessThan"
    metric_measure_column = "AggregatedValue"

  }

  display_name                     = "myvm-auto-deletion-alert"
  enabled                          = true
  action {
    action_groups = [azurerm_monitor_action_group.delete_myvm_action_group.id]
  }
}

resource "azurerm_monitor_action_group" "delete_myvm_action_group" {
  name                = "myvm-auto-deletion-action-group"
  resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
  short_name          = "myvm-autodel"
  tags                = module.metadata.tags

  logic_app_receiver {
    name                    = "myvm-auto-deletion-logicapp"
    resource_id             = azurerm_logic_app_workflow.myvm_task_logicapp.id
    callback_url            = azurerm_logic_app_workflow.myvm_task_logicapp.access_endpoint
    use_common_alert_schema = true
  }

  email_receiver {
    name                    = "sendtoPraveen"
    email_address           = "praveen@goog.gov.net"
    use_common_alert_schema = true
  }
}

resource "azurerm_logic_app_workflow" "myvm_task_logicapp" {
  name                = "myvm-auto-deletion-logicapp"
  location            = "us east"
  resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
}

修改后的告警代码（Code-2） #

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "myvm_task_alert_v2" {
  name                = "myvm-auto-deletion-alert"
  resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
  evaluation_frequency = "PT1H"
  window_duration      = "PT10H" ####################-------------------->变更点1
  scopes               = [data.azurerm_log_analytics_workspace.azurerm_log_analytics_workspace.id]

  severity             = 4
  criteria {
    query                   = <<-QUERY
        Perf
        | where TimeGenerated > ago(1h)
        | where CounterName == "% Processor Time" and InstanceName == "_Total" 
        | project TimeGenerated, Computer, CounterValue, _ResourceId
        | summarize AggregatedValue = avg(CounterValue)  by bin(TimeGenerated, 1h), Computer, _ResourceId   
      QUERY
    time_aggregation_method = "Maximum"
    threshold               = 50.0 ####################-------------------->变更点2
    operator                = "LessThan"
    metric_measure_column = "AggregatedValue"

  }

  display_name                     = "myvm-auto-deletion-alert"
  enabled                          = true
  action {
    action_groups = [azurerm_monitor_action_group.delete_myvm_action_group.id]
  }
}

该问题源于Terraform更新告警资源时，未触发动作组中Logic App接收器的重新绑定，导致Azure后台关联关系失效。以下是几种可行处理方式：

1. 关联告警变更触发动作组重建 #

在动作组资源中添加lifecycle配置，指定当告警的窗口时长或阈值变更时，自动重建动作组，从而重新绑定Logic App接收器：

resource "azurerm_monitor_action_group" "delete_myvm_action_group" {
  name                = "myvm-auto-deletion-action-group"
  resource_group_name = azurerm_resource_group.myvm_task_resource_group.name
  short_name          = "myvm-autodel"
  tags                = module.metadata.tags

  logic_app_receiver {
    name                    = "myvm-auto-deletion-logicapp"
    resource_id             = azurerm_logic_app_workflow.myvm_task_logicapp.id
    callback_url            = azurerm_logic_app_workflow.myvm_task_logicapp.access_endpoint
    use_common_alert_schema = true
  }

  email_receiver {
    name                    = "sendtoPraveen"
    email_address           = "praveen@goog.gov.net"
    use_common_alert_schema = true
  }

  # 当告警的窗口时长或阈值变更时，重建动作组
  lifecycle {
    replace_triggered_by = [
      azurerm_monitor_scheduled_query_rules_alert_v2.myvm_task_alert_v2.window_duration,
      azurerm_monitor_scheduled_query_rules_alert_v2.myvm_task_alert_v2.criteria[0].threshold
    ]
  }
}

执行terraform apply后，动作组会被重建，自动修复Logic App的关联触发逻辑。

2. 临时修改接收器属性触发更新 #

如果不想重建整个动作组，可临时修改logic_app_receiver的name属性（比如添加临时后缀），执行terraform apply后再改回原值，Terraform会重新创建接收器，修复关联问题。

3. 升级AzureRM Provider版本 #

该问题可能是旧版AzureRM Provider的bug，建议升级到最新版（>=3.0），新版本对告警与动作组的关联处理更稳定。在versions.tf中更新配置：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.80.0"
    }
  }
}

执行terraform init -upgrade完成Provider升级。

内容的提问来源于stack exchange，提问作者praveen