"query_frequency" argument only accepts a maximum of one day

[mike-guy]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

./terraform -v
Terraform v0.15.4
on windows_amd64

• provider registry.terraform.io/hashicorp/azurerm v2.60.0
• provider registry.terraform.io/hashicorp/random v3.1.0

Affected Resource(s)

resource "azurerm_sentinel_alert_rule_scheduled"

Terraform Configuration Files

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.60.0"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = "xxxxxxxxxxxxx"
}

resource "azurerm_resource_group" "sentinel-rg" {
  name     = var.resource_group_name
  location = var.location
}


resource "azurerm_log_analytics_workspace" "sentinel-log-analytics-workspace" {
  name                = var.log_analytics_workspace_name
  location            = azurerm_resource_group.sentinel-rg.location
  resource_group_name = azurerm_resource_group.sentinel-rg.name
  sku                 = var.log_analytics_sku
  retention_in_days   = var.log_analytics_retention_days
}

resource "azurerm_log_analytics_solution" "sentinel-solution" {
  solution_name         = "SecurityInsights"
  location              = azurerm_resource_group.sentinel-rg.location
  resource_group_name   = azurerm_resource_group.sentinel-rg.name
  workspace_resource_id = azurerm_log_analytics_workspace.sentinel-log-analytics-workspace.id
  workspace_name        = azurerm_log_analytics_workspace.sentinel-log-analytics-workspace.name

  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/SecurityInsights"
  }
}

resource "random_uuid" "test" {
}


resource "azurerm_sentinel_alert_rule_scheduled" "test" {
  name                       = random_uuid.test.result
  display_name               = "Display name is here"
  description                = "Description is here"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.sentinel-log-analytics-workspace.id
  tactics                    = ["Execution"]
  severity                   = "Low"
  query_frequency            = "P3D"
  query_period               = "P3D"
  query                      = <<QUERY
    AzureActivity
    | where ActivityStatus == "Completelymadeup"
    QUERY
  enabled                    = true
  #suppression_duration       = "PT5H"
  suppression_enabled = false
  trigger_operator    = "GreaterThan"
  trigger_threshold   = "0"
  event_grouping {
    aggregation_method = "SingleAlert"
  }
  incident_configuration {
    create_incident = true
    grouping {
      enabled = false
      #lookback_duration       = PT5H
      #reopen_closed_incidents = false
      #entity_matching_method  = "All"
      #group_by = ""
    }
  }
  depends_on = [azurerm_log_analytics_solution.sentinel-solution]
}

Debug Output

Not provided.

Panic Output

Not provided - N/A.

Expected Behaviour

Expect to be able to set a query_frequency greater than "P1D" (one day). This is possible in the Sentinel portal as shown below:

Actual Behaviour

Received an error stating that the argument can be a maximum of 24h.

│ Error: expected query_frequency to be in the range (5m0s - 24h0m0s), got 72h0m0s
│
│   with azurerm_sentinel_alert_rule_scheduled.test,
│   on main.tf line 6423, in resource "azurerm_sentinel_alert_rule_scheduled" "test":
│ 6423: resource "azurerm_sentinel_alert_rule_scheduled" "test" {

Steps to Reproduce

Create a scheduled rule with a query_frequency higher than 24 hours/1 day.

Important Factoids

N/A

References

N/A

[kaovd]

Seems Sentinel now allows a query frequency of above 1 day to the full 14 days - will take a look.

[ghost]

This has been released in version 2.63.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 2.63.0"
}
# ... other configuration ...

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.