Azure Activity Log Alerts失效：Terraform配置后未触发告警

问题描述 #

使用以下Terraform代码在Azure中创建了活动日志告警：

// We need to define the action group for Security Alerts
resource "azurerm_monitor_action_group" "monitor_action_group_soc" {
  name                = "sec-alert"
  resource_group_name = data.azurerm_resource_group.tenant-global.name
  short_name          = "sec-alert"

   email_receiver {
    name                    = "sendtoAdmin"
    email_address           = var.email_address
    use_common_alert_schema = true
  }
}

data "azurerm_monitor_action_group" "monitor_action_group_soc" {
  name                = "sec-alert"
  resource_group_name = var.tenant-global-rg

  depends_on = [
    azurerm_monitor_action_group.monitor_action_group_soc
  ]
}

// Monitor Activity Log and Alert
resource "azurerm_monitor_activity_log_alert" "activity_log_alert_cu_security_group" {
  name                = "Activity Log Alert for Create or Update Security Group"
  resource_group_name = data.azurerm_resource_group.ipz12-dat-np-mgmt-rg.name
  scopes              = [data.azurerm_subscription.current.id]
  description         = "Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity"

  criteria {
    category       = "Security"
    operation_name = "Microsoft.Network/networkSecurityGroups/write"
  }

  action {
    action_group_id = data.azurerm_monitor_action_group.monitor_action_group_soc.id
  }
}

执行创建Network Security Group、添加规则、删除规则及删除Network Security Group的操作后，未收到任何告警通知。

核心问题分析 #

• 类别设置错误：NSG的创建/更新/删除操作属于Administrative活动日志类别，而非代码中设置的Security类别。Security类别对应Azure安全中心生成的安全告警事件，并非资源管理操作日志。
• 监控操作不完整：当前仅监控了Microsoft.Network/networkSecurityGroups/write（创建/更新NSG），未覆盖规则增删（Microsoft.Network/networkSecurityGroups/securityRules/write、Microsoft.Network/networkSecurityGroups/securityRules/delete）和NSG删除（Microsoft.Network/networkSecurityGroups/delete）操作。
• 冗余数据块：无需通过data块引用已创建的action group，直接使用资源的ID即可，减少不必要的依赖。

修正后的Terraform代码 #

// 创建告警动作组
resource "azurerm_monitor_action_group" "monitor_action_group_soc" {
  name                = "sec-alert"
  resource_group_name = data.azurerm_resource_group.tenant-global.name
  short_name          = "sec-alert"

  email_receiver {
    name                    = "sendtoAdmin"
    email_address           = var.email_address
    use_common_alert_schema = true
  }
}

// 监控NSG相关的所有管理操作
resource "azurerm_monitor_activity_log_alert" "activity_log_alert_nsg_operations" {
  name                = "Activity Log Alert for NSG Operations"
  resource_group_name = data.azurerm_resource_group.ipz12-dat-np-mgmt-rg.name
  scopes              = [data.azurerm_subscription.current.id]
  description         = "监控Network Security Group的创建、更新、删除及规则变更操作"

  criteria {
    category       = "Administrative"
    operation_name = [
      "Microsoft.Network/networkSecurityGroups/write",
      "Microsoft.Network/networkSecurityGroups/delete",
      "Microsoft.Network/networkSecurityGroups/securityRules/write",
      "Microsoft.Network/networkSecurityGroups/securityRules/delete"
    ]
  }

  action {
    action_group_id = azurerm_monitor_action_group.monitor_action_group_soc.id
  }
}

额外排查步骤 #

• 验证动作组有效性：在Azure门户中手动触发动作组测试，确认邮件接收正常。
• 检查活动日志事件：在Azure活动日志中搜索对应的NSG操作，确认事件已生成且类别为Administrative。
• 确认告警规则状态：检查告警规则是否处于启用状态，资源组和订阅范围是否正确。

内容的提问来源于stack exchange，提问作者One Developer