azurerm_sentinel_alert_rule_* - upgrade API version#28195
azurerm_sentinel_alert_rule_* - upgrade API version#28195stephybun merged 12 commits intohashicorp:mainfrom
azurerm_sentinel_alert_rule_* - upgrade API version#28195Conversation
github-actions
bot
added
enhancement
documentation
dependencies
service/sentinel
size/XL
labels
ziyeqf
changed the title
azurerm_sentinel_alert_rule_scheduled - upgrade API versionazurerm_sentinel_alert_rule_* - upgrade API version
stephybun
left a comment
stephybun
left a comment
There was a problem hiding this comment.
@ziyeqf we always ask that updating the go-azure-sdk is done in a separate PR because this gets updated often and ends up causing conflicts for PRs which prevent su from running the tests. Going forward can you please make sure to update the go-azure-sdk in a separate PR, please also resolve the merge conflict so we can run the tests.
|
Hey @stephybun, thanks. May I confirm |
|
By updating the |
| entity_mapping { | ||
| entity_type = "Account" | ||
| field_mapping { | ||
| identifier = "Name" | ||
| column_name = "Computer" | ||
| } | ||
| } | ||
| entity_mapping { | ||
| entity_type = "Account" | ||
| field_mapping { | ||
| identifier = "Name" | ||
| column_name = "Category" | ||
| } | ||
| } | ||
| entity_mapping { | ||
| entity_type = "Account" | ||
| field_mapping { | ||
| identifier = "Name" | ||
| column_name = "OSType" | ||
| } | ||
| } |
There was a problem hiding this comment.
Minor, but spacing consistency
| entity_mapping { | |
| entity_type = "Account" | |
| field_mapping { | |
| identifier = "Name" | |
| column_name = "Computer" | |
| } | |
| } | |
| entity_mapping { | |
| entity_type = "Account" | |
| field_mapping { | |
| identifier = "Name" | |
| column_name = "Category" | |
| } | |
| } | |
| entity_mapping { | |
| entity_type = "Account" | |
| field_mapping { | |
| identifier = "Name" | |
| column_name = "OSType" | |
| } | |
| } | |
| entity_mapping { | |
| entity_type = "Account" | |
| field_mapping { | |
| identifier = "Name" | |
| column_name = "Computer" | |
| } | |
| } | |
| entity_mapping { | |
| entity_type = "Account" | |
| field_mapping { | |
| identifier = "Name" | |
| column_name = "Category" | |
| } | |
| } | |
| entity_mapping { | |
| entity_type = "Account" | |
| field_mapping { | |
| identifier = "Name" | |
| column_name = "OSType" | |
| } | |
| } |
| Type: pluginsdk.TypeList, | ||
| Optional: true, | ||
| MaxItems: 5, | ||
| MaxItems: 10, |
There was a problem hiding this comment.
Although the error message provided by the API is descriptive and it seems like it makes sense to hand off the validation to the API, I think we should actually keep the MaxItems validation in the schema here because there's value in informing the user earlier of any config issues at plan time, instead of at apply time. WDYT?
There was a problem hiding this comment.
Any news on when this MaxItems will be increased? We are currently unable to deploy the latest Microsoft templates due to them containing more than 5 entity mapping items in the templates they provide?
There was a problem hiding this comment.
@kevinbasoftcat, we're waiting on the author to fix the new test failures mentioned in this comment. @ziyeqf the failures due to quota are ok, but the new test failures should still be looked at.
stephybun
left a comment
stephybun
left a comment
There was a problem hiding this comment.
There are also new test failures:
------- Stdout: -------
=== RUN TestAccSentinelAlertRuleAnomalyDataSource_basicWithMultiSelect
=== PAUSE TestAccSentinelAlertRuleAnomalyDataSource_basicWithMultiSelect
=== CONT TestAccSentinelAlertRuleAnomalyDataSource_basicWithMultiSelect
testcase.go:173: Step 1/1 error: Error running apply: exit status 1
Error: reading Sentinel Anomaly Rule (Display Name "Attempted user account bruteforce per logon type") was not found
with data.azurerm_sentinel_alert_rule_anomaly.test,
on terraform_plugin_test.tf line 49, in data "azurerm_sentinel_alert_rule_anomaly" "test":
49: data "azurerm_sentinel_alert_rule_anomaly" "test" {
reading Sentinel Anomaly Rule (Display Name "Attempted user account
bruteforce per logon type") was not found
--- FAIL: TestAccSentinelAlertRuleAnomalyDataSource_basicWithMultiSelect (164.09s)
FAIL
------- Stdout: -------
=== RUN TestAccSentinelAlertRuleAnomalyDataSource_basicWithPrioritized
=== PAUSE TestAccSentinelAlertRuleAnomalyDataSource_basicWithPrioritized
=== CONT TestAccSentinelAlertRuleAnomalyDataSource_basicWithPrioritized
testcase.go:173: Step 1/1 error: Error running apply: exit status 1
Error: reading Sentinel Anomaly Rule (Display Name "Rare privileged process calls on a daily basis") was not found
with data.azurerm_sentinel_alert_rule_anomaly.test,
on terraform_plugin_test.tf line 49, in data "azurerm_sentinel_alert_rule_anomaly" "test":
49: data "azurerm_sentinel_alert_rule_anomaly" "test" {
reading Sentinel Anomaly Rule (Display Name "Rare privileged process calls on
a daily basis") was not found
--- FAIL: TestAccSentinelAlertRuleAnomalyDataSource_basicWithPrioritized (181.55s)
FAIL
Also quite a few failures with a quota/capacity error:
------- Stdout: -------
=== RUN TestAccSentinelAlertRuleNrt_basic
=== PAUSE TestAccSentinelAlertRuleNrt_basic
=== CONT TestAccSentinelAlertRuleNrt_basic
testcase.go:173: Step 1/3 error: Error running apply: exit status 1
Error: creating "Alert Rule (Subscription: \"*******\"\nResource Group Name: \"acctestRG-sentinel-241211091031520920\"\nWorkspace Name: \"acctestLAW-241211091031520920\"\nRule: \"acctest-SentinelAlertRule-NRT-241211091031520920\")": unexpected status 400 (400 Bad Request) with error: BadRequest: Maximum rules count per tenant exceeds the allowed limit 10000. please contact support if this an intentional action.
with azurerm_sentinel_alert_rule_nrt.test,
on terraform_plugin_test.tf line 49, in resource "azurerm_sentinel_alert_rule_nrt" "test":
49: resource "azurerm_sentinel_alert_rule_nrt" "test" {
--- FAIL: TestAccSentinelAlertRuleNrt_basic (177.92s)
FAIL
Is there anything we can do about these? ☝️ maybe run certain tests sequentially instead of in parallel so we don't hit the limit?
|
For the testing result, I'm suspecting, different tenants/subscriptions have different available rule template... |
|
any update on this ? |
|
Hi @stephybun, seems the "not found" rules are avaliable in the testing subscription and some of the tests passed, but there are still some failures due to capacity. Mind take another look? |
* CHANGELOG.md for v4.19.0 * Update CHANGELOG.md #28523 * Update CHANGELOG.md #28691 * Updated to include #28717 * Update for #26680 * Update CHANGELOG.md #28633 * Update CHANGELOG.md for #28703 * Update CHANGELOG.md for #28391 * Update CHANGELOG.md #28725 * Update #28733 * Update CHANGELOG.md #28659 * Update for #28741 * Update CHANGELOG.md #28712 * Update CHANGELOG.md #28441 * Update CHANGELOG.md #28441 * Update CHANGELOG.md #28441 * Update CHANGELOG.md for #28602 * Update for #27424 * Update CHANGELOG.md for #28524 * Update CHANGELOG.md #28726 * Update for #28767 * Update for #28195 * prep for release v4.19.0 --------- Co-authored-by: sreallymatt <106555974+sreallymatt@users.noreply.github.com> Co-authored-by: Wodans Son <20408400+WodansSon@users.noreply.github.com> Co-authored-by: stephybun <steph@hashicorp.com> Co-authored-by: Wyatt Fry <wyattfry@gmail.com> Co-authored-by: Matthew Frahry <mbfrahry@gmail.com> Co-authored-by: jackofallops <ste@hashicorp.com>
* `azurerm_sentinel_alert_rule_scheduled` - upgrade API version * expand count limitation for `entity_mapping` and `sentinel_entity_mapping` * add test case * replace `utils` functions * update other sentinel alert rules api version * update acctest * fresh vendor * revert useless functions * remove duplicate function * address comment
* CHANGELOG.md for v4.19.0 * Update CHANGELOG.md hashicorp#28523 * Update CHANGELOG.md hashicorp#28691 * Updated to include hashicorp#28717 * Update for hashicorp#26680 * Update CHANGELOG.md hashicorp#28633 * Update CHANGELOG.md for hashicorp#28703 * Update CHANGELOG.md for hashicorp#28391 * Update CHANGELOG.md hashicorp#28725 * Update hashicorp#28733 * Update CHANGELOG.md hashicorp#28659 * Update for hashicorp#28741 * Update CHANGELOG.md hashicorp#28712 * Update CHANGELOG.md hashicorp#28441 * Update CHANGELOG.md hashicorp#28441 * Update CHANGELOG.md hashicorp#28441 * Update CHANGELOG.md for hashicorp#28602 * Update for hashicorp#27424 * Update CHANGELOG.md for hashicorp#28524 * Update CHANGELOG.md hashicorp#28726 * Update for hashicorp#28767 * Update for hashicorp#28195 * prep for release v4.19.0 --------- Co-authored-by: sreallymatt <106555974+sreallymatt@users.noreply.github.com> Co-authored-by: Wodans Son <20408400+WodansSon@users.noreply.github.com> Co-authored-by: stephybun <steph@hashicorp.com> Co-authored-by: Wyatt Fry <wyattfry@gmail.com> Co-authored-by: Matthew Frahry <mbfrahry@gmail.com> Co-authored-by: jackofallops <ste@hashicorp.com>
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions. |
4 participants
Community Note
Description
Upgrade API version to
2023-12-01-preview, which is consistent with Portal. And expanding the limitation onentity_mappingandsentinel_entity_mappingto 10.The error message from service, when there are more than 10
entity_mappingisAs mentioned on #27832, Can we consider remove the
maxItemslimitation and let the service decide the limitation?Also, other sentinel alert rules are upgraded to this API version, without further modification.
PR Checklist
For example: “
resource_name_here- description of change e.g. adding propertynew_property_name_here”Changes to existing Resource / Data Source
Testing
Change Log
Below please provide what should go into the changelog (if anything) conforming to the Changelog Format documented here.
azurerm_sentinel_alert_rule_scheduled- upgrade API version [azurerm_sentinel_alert_rule_*- upgrade API version #28195]azurerm_sentinel_alert_rule_fusion- upgrade API version [azurerm_sentinel_alert_rule_*- upgrade API version #28195]azurerm_sentinel_alert_rule_machine_learning_behavior_analytics- upgrade API version [azurerm_sentinel_alert_rule_*- upgrade API version #28195]azurerm_sentinel_alert_rule_ms_security_incident- upgrade API version [azurerm_sentinel_alert_rule_*- upgrade API version #28195]azurerm_sentinel_alert_rule_nrt- upgrade API version [azurerm_sentinel_alert_rule_*- upgrade API version #28195]This is a (please select all that apply):
Related Issue(s)
Fixes #27722
Note
If this PR changes meaningfully during the course of review please update the title and description as required.