Azure / Azure/azure-cli-extensions
scheduled-query extension does not skip validation
- Dominant language
- Python
- Stars
- 454
- Forks
- 1.7k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 64
Description
### Related command
```
az monitor scheduled-query create
```
### Extension name (the extension in question)
scheduled-query
### Description of issue
When running the following command on a newly created keyvault:
```
QUERY='AzureDiagnostics | where clientInfo_s !contains "Go/go" | where OperationName == "SecretSet" or OperationName == "SecretGet" or OperationName == "SecretUpdate" or OperationName == "SecretDelete" or OperationName == "SecretPurge" | mv-expand parse_json(AdditionalFields) | extend User=AdditionalFields["identity_claim_unique_name"] | where User != "" | project TimeGenerated, User, OperationName, requestUri_s | sort by TimeGenerated desc'
az monitor scheduled-query create \
--name "Keyvault Access - ${keyvault_name}" \
--resource-group ${keyvault_resource_group} \
--scopes ${SQ_SCOPE} \
--description "Keyvault Access - ${keyvault_name}" \
--evaluation-frequency 1h \
--window-size 1h \
--severity 3 \
--skip-query-validation true \
--target-resource-type Microsoft.KeyVault/vaults \
--condition "count 'QRY1' > 0" \
--condition-query QRY1="${QUERY}"
```
I get the error:
'mvexpand' operator: Failed to resolve scalar expression named 'AdditionalFields'
Which is logical normally when the keyvault was just created. However, I have used the --skip-query-validation true flag, and it looks like the query is still getting validated.
It should completely skip validation and implement the alert rule.
Contributor guide
Assessment
This issue has not been assessed yet.