Azure / Azure/terraform-provider-azapi
Terraform/Bicep Sentinel Connectors: Microsoft.SecurityInsights/contentProductPackages@2025-03-01
- Dominant language
- Go
- Stars
- 244
- Forks
- 97
- Avg merge
- 5d 9h
- Merged PRs (30d)
- 9
Description
**Describe the bug**
A clear and concise description of what the bug is.
I am trying to deploy Sentinel Connector using Terraform/Bicep, however seems that output data from API is trunkated.
**To Reproduce**
Steps to reproduce the behavior:
1. Create log analytics workspace + onboard Azure Sentinel
2. Example: Azure Activity
3. User Terraform data source
```
data "azapi_resource" "get_defined_contentProductPackages" {
type = "Microsoft.SecurityInsights/contentProductPackages@2025-03-01"
name = "azuresentinel.azure-sentinel-solution-azureactivit-sl-x6rxfrmsjp3pw"
parent_id = "/subscriptions/${subscriptionID}/resourceGroups/${resourceGroup}/providers/microsoft.operationalinsights/workspaces/${logAnalyticsName}"
response_export_values = ["properties"]
}
```
4. Output contains multiple contentPackages including:
https://gist.github.com/bisskar/7a720b23c42bca01869627c888b8e323
5. Data is truncated.
6. Expected fields:
```
id
title
publisher
descriptionMarkdown
logo
lastDataReceivedInfoBalloon
graphQueries
sampleQueries
connectivityCriterias
dataTypes
availability
permissions
instructionSteps
metadata
```
7. Response fields:
```
connectorUiConfig:
{
connectivityCriterias
dataTypes
descriptionMarkdown
graphQueries
id
publisher
title
}
```
**Expected behavior**
How output should look like:
https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Azure%20Activity/Data%20Connectors/AzureActivity.json
**Additional context**
Missing resource properties prevents deploying data connector, to be more specific "Microsoft.OperationalInsights/workspaces/providers/contentTemplates" using Bicep/Terraform dynamically,
While deploying resource using terraform,deployment is successful, connectors are not visible in Sentinel.
Attached TF code - the same approach works properly for Analytics, Workbooks and Playbooks.
Connectors are causing issues.
Same API response using different API versions.
Example terraform config:
https://gist.github.com/bisskar/fe2959085ed11159ada6c6b818495c2e
Please ignore hardcoded values, subscription does no longer exist.
Contributor guide
Research direction
Start with the attached Terraform configuration and the azapi_resource data source using Microsoft.SecurityInsights/contentProductPackages@2025-03-01; compare its response_export_values output with the linked Azure Activity JSON and the listed expected fields. Done means the connector properties are returned without truncation and the dynamically deployed connector becomes visible in Sentinel.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go, terraform
- Domain
- api, cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100