Configure observability for the vnet-app Storage Account - #615
Open
Roger Doherty (MSFT) (doherty100) wants to merge 2 commits into
Open
Configure observability for the vnet-app Storage Account#615Roger Doherty (MSFT) (doherty100) wants to merge 2 commits into
Roger Doherty (MSFT) (doherty100) wants to merge 2 commits into
Conversation
Wire the observability framework (diagnostic settings to the shared Log Analytics workspace) into the vnet-app storage account, mirroring the container registry. - Add azurerm_monitor_diagnostic_setting resources on the blob and file sub-services emitting StorageRead/StorageWrite/StorageDelete logs and Transaction metrics to the shared Log Analytics workspace. Queue and table services are omitted since the account only uses blob and file. - Include the new diagnostic settings in the storage_operations_complete barrier signal so the public-access barrier waits for them before disabling public network access. - Add a unit test verifying the blob and file diagnostic settings stream the expected logs and metrics to Log Analytics. - Update module and root README documentation. Fixes #608 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Diagnostic settings are control-plane resources and their log/metric delivery flows service-to-service on the Azure backend, so they do not traverse the storage account's public_network_access boundary. They do not need to gate the public-access barrier; revert the storage_operations_complete signal to its original blob/share writes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates the
vnet-appStorage Account with the observability framework (shared Log Analytics workspace), closing the gap where the storage account emitted no diagnostics while sibling resources (Container Registry, Application Insights) already did.Fixes #608.
Changes
modules/vnet-app/storage.tf— Addazurerm_monitor_diagnostic_setting.storage_bloband.storage_filetargeting theblobServices/defaultandfileServices/defaultsub-resources, emittingStorageRead,StorageWrite,StorageDeletelogs andTransactionmetrics tovar.log_analytics_workspace_id. StorageRead/Write/Delete logs live at the sub-service scope, so both sub-services are targeted. Queue/table are intentionally omitted since the account only uses blob and file.modules/vnet-app/main.tf— Include the two diagnostic setting IDs in thestorage_operations_completebarrier signal so the public-access barrier waits for them before disabling public network access.modules/vnet-app/scripts/Test-VnetApp.ps1— Add Test 19 verifying the blob and file diagnostic settings stream the expected logs + Transaction metrics to a Log Analytics workspace (via ARMdiagnosticSettingsGET on each sub-resource).modules/vnet-app/README.mdresources table and the rootREADME.mdstorage bullets.Acceptance criteria
modules/vnet-app/README.mdand rootREADME.mdresources tables updated../scripts/Invoke-CIChecks.sh terraform markdownpasses (also ranpowershell).Notes
The existing
log_analytics_workspace_idmodule input is reused — no new variables or root wiring required. Noterraform applywas run; validation is via local CI checks (terraform fmt,tflint,markdownlint, PSScriptAnalyzer — all pass).