如何通过Terraform配置GCP KMS密钥删除告警并阻止自动清除？

我用Terraform配置GCP告警策略监控KMS密钥删除，已经搭好了日志指标、告警策略和PagerDuty通知通道，功能正常，但告警触发后会自动清除。我的配置代码如下：

resource "google_logging_metric" "logging_metric" {
    name        = "kms-key-pending-deletion"
    description = "Logging metric used to alert on scheduled deletions of KMS keys"
    filter      = "resource.type=cloudkms_cryptokeyversion AND protoPayload.methodName=DestroyCryptoKeyVersion"
    metric_descriptor {
        metric_kind  = "DELTA"
        value_type   = "INT64"
        unit         = "1"
        display_name = "kms-key-deletion-metric-descriptor"
    }
}

resource "google_monitoring_notification_channel" "pagerduty_alerts" {
    display_name = "pagerduty-notification-channel"
    type         = "pagerduty"
    sensitive_labels {
        service_key = var.token
    }
}

resource "google_monitoring_alert_policy" "kms_key_deletion_alert_policy" {
    display_name          = "kms-key-deletion-alert-policy"
    combiner              = "OR"
    notification_channels = [google_monitoring_notification_channel.pagerduty_alerts.name]
    conditions {
        display_name = "kms-key-deletion-alert-policy-conditions"
        condition_threshold {
            comparison      = "COMPARISON_GT"
            duration        = "300s"
            filter          = "metric.type=\"logging.googleapis.com/user/kms-key-pending-deletion\" AND resource.type=\"global\""
            threshold_value = "0"
        }
    }
    documentation {
        content = "Runbook: https://blah"
    }
}

在GCP图形界面里关闭「Notify on incident closure」选项可以阻止告警清除，但用Terraform设置alert_strategy.auto_close为null或"0s"都没用：

alert_strategy {
    auto_close = "0s"
    # auto_close = null
}

请问怎么通过Terraform配置让告警保持激活不自动清除？是否应该改用监控cloudkms.cryptoKey处于"DESTROY_SCHEDULED"状态的方式？

一、正确配置Terraform阻止告警自动关闭 #

GCP监控的alert_strategy.auto_close字段设置为"0s"确实是禁用自动关闭的正确方式，但必须同时配置notification_channel_strategy关闭事件闭合通知，否则即使自动关闭被禁用，PagerDuty还是会收到闭合通知。完整配置如下：

resource "google_monitoring_alert_policy" "kms_key_deletion_alert_policy" {
    display_name          = "kms-key-deletion-alert-policy"
    combiner              = "OR"
    notification_channels = [google_monitoring_notification_channel.pagerduty_alerts.name]
    
    # 禁用自动关闭告警
    alert_strategy {
        auto_close = "0s"
    }

    # 关闭事件闭合时的通知，对应UI的「Notify on incident closure」选项
    notification_channel_strategy {
        channel = google_monitoring_notification_channel.pagerduty_alerts.name
        notify_on_closure = false
    }

    conditions {
        display_name = "kms-key-deletion-alert-policy-conditions"
        condition_threshold {
            comparison      = "COMPARISON_GT"
            duration        = "300s"
            filter          = "metric.type=\"logging.googleapis.com/user/kms-key-pending-deletion\" AND resource.type=\"global\""
            threshold_value = "0"
        }
    }
    documentation {
        content = "Runbook: https://blah"
    }
}

• alert_strategy.auto_close = "0s"：告知GCP不要自动关闭事件，保持激活状态直到手动确认。
• notification_channel_strategy.notify_on_closure = false：阻止PagerDuty收到事件闭合的消息，和UI选项效果一致。

之前仅设置auto_close未配置notification_channel_strategy，导致设置无效。

二、评估监控KMS密钥状态的替代方案 #

如果希望持续跟踪密钥待删除状态的整个周期，改用监控cloudkms.cryptoKey的DESTROY_SCHEDULED状态是更优选择，原因如下：

1. 原日志指标仅捕获密钥被标记为待删除的瞬间动作，无法持续监控状态存在。
2. 直接监控密钥状态可在整个待删除周期内保持告警激活，直到密钥被恢复或彻底删除。

配置步骤 #

1. 创建基于KMS密钥状态的监控指标：

resource "google_monitoring_metric" "kms_key_destroy_scheduled" {
    name        = "kms-key-destroy-scheduled"
    description = "Metric tracking KMS keys in DESTROY_SCHEDULED state"
    filter      = "metric.type=\"cloudkms.googleapis.com/crypto_key/state\" AND resource.type=\"cloudkms_cryptokey\" AND metric.labels.state=\"DESTROY_SCHEDULED\""
    aggregation {
        alignment_period   = "300s"
        per_series_aligner = "ALIGN_COUNT"
    }
}

2. 更新告警策略使用该指标：

resource "google_monitoring_alert_policy" "kms_key_deletion_alert_policy" {
    display_name          = "kms-key-deletion-alert-policy"
    combiner              = "OR"
    notification_channels = [google_monitoring_notification_channel.pagerduty_alerts.name]
    
    alert_strategy {
        auto_close = "0s"
    }

    notification_channel_strategy {
        channel = google_monitoring_notification_channel.pagerduty_alerts.name
        notify_on_closure = false
    }

    conditions {
        display_name = "kms-key-destroy-scheduled-condition"
        condition_threshold {
            comparison      = "COMPARISON_GT"
            duration        = "0s"
            filter          = "metric.type=\"custom.googleapis.com/kms-key-destroy-scheduled\" AND resource.type=\"cloudkms_cryptokey\""
            threshold_value = "0"
        }
    }
    documentation {
        content = "Runbook: https://blah"
    }
}

这种方式能持续监控密钥待删除状态，只要状态未解除，告警就会保持激活，更贴合监控需求。

内容的提问来源于stack exchange，提问作者AlRal