Azure / Azure/azure-rest-api-specs
[BUG] Terraform/Bicep Sentinel Connectors: Microsoft.SecurityInsights/contentProductPackages@2025-03-01
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 444
Description
### API Spec link
https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/contentpackages?pivots=deployment-language-terraform
### API Spec version
2025-03-01
### Describe the bug
**Describe the bug**
A clear and concise description of what the bug is.
I am trying to deploy Sentinel Connector using Terraform/Bicep, however seems that output data from API is trunkated.
### Expected behavior
1. Expected fields:
```
id
title
publisher
descriptionMarkdown
logo
lastDataReceivedInfoBalloon
graphQueries
sampleQueries
connectivityCriterias
dataTypes
availability
permissions
instructionSteps
metadata
```
2. Response fields:
```
connectorUiConfig:
{
connectivityCriterias
dataTypes
descriptionMarkdown
graphQueries
id
publisher
title
}
```
### Actual behavior
1. Output contains multiple contentPackages including:
https://gist.github.com/bisskar/7a720b23c42bca01869627c888b8e323
2. Data is truncated for DataConnectors
### Reproduction Steps
**To Reproduce**
Steps to reproduce the behavior:
1. Create log analytics workspace + onboard Azure Sentinel
2. Example: Azure Activity
3. User Terraform data source
```
data "azapi_resource" "get_defined_contentProductPackages" {
type = "Microsoft.SecurityInsights/contentProductPackages@2025-03-01"
name = "azuresentinel.azure-sentinel-solution-azureactivit-sl-x6rxfrmsjp3pw"
parent_id = "/subscriptions/${subscriptionID}/resourceGroups/${resourceGroup}/providers/microsoft.operationalinsights/workspaces/${logAnalyticsName}"
response_export_values = ["properties"]
}`
```
**Additional context**
Missing resource properties prevents deploying data connector, to be more specific "Microsoft.OperationalInsights/workspaces/providers/contentTemplates" using Bicep/Terraform dynamically,
While deploying resource using terraform,deployment is successful, connectors are not visible in Sentinel.
Attached TF code - the same approach works properly for Analytics, Workbooks and Playbooks.
Connectors are causing issues.
Same API response using different API versions.
Example terraform config:
https://gist.github.com/bisskar/fe2959085ed11159ada6c6b818495c2e
Please ignore hardcoded values, subscription does no longer exist.
### Environment
_No response_
Contributor guide
Research direction
Start with the linked Microsoft.SecurityInsights/contentProductPackages@2025-03-01 API specification and reproduce the response using the shown Terraform azapi_resource data source. Compare the connectorUiConfig fields with the expected fields and the contentTemplates deployment behavior. Done means the response exposes the required connector properties and the deployed connectors appear in Sentinel; no repository file or test is named.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, terraform
- Domain
- api, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100