azurerm_sentinel_alert_rule_nrt support for event_grouping block

[kevkele]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

The azurerm_sentinel_alert_rule_nrt resource introduced in #15999 from issue #14973 doesn't yet support the event_grouping block found in sentinel_alert_rule_scheduled. event_grouping is an option under Sentinel's NRT rules.

Under azurerm version 3.24.0, we see the error:

Error: Unsupported block type

  on rules-example.tf line 600, in resource "azurerm_sentinel_alert_rule_nrt" "example":
 600:   event_grouping {

Blocks of type "event_grouping" are not expected here.

New or Affected Resource(s)/Data Source(s)

azurerm_sentinel_alert_rule_nrt

Potential Terraform Configuration

resource "azurerm_sentinel_alert_rule_nrt" "example" {
  name                       = "example"
  log_analytics_workspace_id = azurerm_log_analytics_solution.example.workspace_resource_id
  display_name               = "example"
  severity                   = "High"
  query                      = <<QUERY
AzureActivity |
  where OperationName == "Create or Update Virtual Machine" or OperationName =="Create Deployment" |
  where ActivityStatus == "Succeeded" |
  make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
QUERY

  event_grouping {
    aggregation_method = "AlertPerResult"
  }

}

References

• New resource: azurerm_sentinel_alert_rule_nrt #15999
• Support for azurerm_sentinel_alert_rule_nrt resource #14973

[magodo]

This new property is introduced in API version 2022-09-01-preview, while the current API version under used is 2022-01-01-preview. The Azure SDK track1 is feature frozen, and its latest version is 2022-01-01-preview. We are migrating the underlying SDK from Azure SDK track1 to the hashicorp/go-azure-sdk, whilst there is some internal issue blocking this migration for now.

[kevkele]

Chiming in to say that this was added in #20231