Questions[azure-arm-template](server)

Background: Apparently Packer has major issues configuring WinRM on Azure VMs created from the Microsoft Windows Server publisher. This is only one of the several issues and threads I've found on this and it dates back several years. Because of this I'm unable to connect to an instance with Packer in order to provision and prepare our own Windows images for use within our company. I've tried altering timeouts, I've tried different VM sizes, none of it works. Packer's ARM template is just garbage at configuring WinRM. And they are not willing to fix the problem. In a suggestion to provide a way to run a script on Azure in the same way as AWS' userdata, Hashicorp's asinine "solution" is to "prepare a custom image to process the custom-data script so you can prepare a custom image with packer". They even suggest it can't be done by their code which is outright false.

I already do this myself in AWS by configuring a userdata script to run, which configures WinRM and the firewall. I was able to find that Azure has a similar feature called custom-data, and while I can set this using the azure-arm source, for some "lovely" reason Windows does not have a way to run it, only Linux does via cloud-init. I can run what I need using Invoke-AzVMRunCommand (whether it's custom-data or not which FIXES THE PROBLEM! HUZZAH! Except Packer does not (that I can find) provide a way to run "pre-connection" commands from builder, you only have this option once you hit the provisioner. My provisioner code will not run until the connection to WinRM is established. Chicken, meet egg (or is it the other way around?)

So I am unable automate this with Packer in its current state unless I am missing something. Yet, I am unable to use a different tool here for image building due to internal politics and procedures. I apologize if this background comes off a bit ranty, I am extremely tired and frustrated with this issue.

The question: Are there any ideas out there that don't involve creating an intermediary custom image via some other process that will allow me to run a script at provisioning time against a Windows Azure VM? Are there alternate Azure builders for use with Packer that might help? Or perhaps an Azure publisher who publishes Windows images which already have the capability of running custom-data on launch? Or perhaps is there a trick of Packer I haven't considered here yet? If I could just run an Azure CLI command from the builder once the VM is created I could solve this quickly.

My other thoughts are to fork the azure-arm builder and add the capability I need myself, or write my own provider entirely. The former solution might be feasible, and I could contribute the code back (if Hashicorp won't reject it because "it's not their way"), but the latter seems heavy-handed for the situation. In addition, I don't know Go so I'd have to pick it up and it's... different from many. In either event, I would like to avoid developing my own code for a solution if there is already a real solution to this scenario.

Many thanks in advance for consideration of this issue.

We have a Azure DevOps pipeline that first deploys our resources using ARM-templates and then deploys our AppServices using zips. We've run the pipeline multiple times, and the application is correctly running.

Sometime after in another deployment attempt - the first deployment step (of the resources) fails. The changes in the deployment do not contain any changes to the AppService. And the failed part is not the AppService (but instead say our database), the AppService still becomes unavailable. And it looks like it has reset to the deafult hosting settings. It seems the previous deployments are still available in the "/data/SitePackages" folder, but the "/site/wwwroot" folder contains only the default "hostingstart.html" file.

My understanding from an incremental deployment is that if the AppService is unchanged it should keep all it's settings! (And thus it's previous deployment active.)

Is this default behaviour? Can we somehow keep the previous App running when part of the deployment fails? Do we need to choose another deployment strategy?

Our pipeline looks something like this;

jobs:
  - deployment: 'Deploy'
    environment: '${{ parameters.environment }}' # The environment to use in Azure Devops (controls the required approvals)
    variables:
      - template: '../variables/deploy-variables.yml'
        parameters:
          environment: '${{ parameters.environment }}'
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureResourceManagerTemplateDeployment@3
            displayName: 'Azure - Deploy resources'
            inputs:
              deploymentScope: 'Resource Group'
              azureResourceManagerConnection: '${{ parameters.azureServiceConnection }}'
              subscriptionId: '$(azureSubscriptionId)'
              action: 'Create Or Update Resource Group'
              resourceGroupName: '$(resourceGroup)'
              location: 'West Europe'
              templateLocation: 'Linked artifact'
              csmFile: '$(Pipeline.Workspace)/drop-resources/files/arm/resources/azuredeploy.json'
              csmParametersFile: '$(Pipeline.Workspace)/drop-resources/files/arm/resources/azuredeploy.parameters.json'
              deploymentMode: 'Incremental'

          - task: AzureWebApp@1
            displayName: 'Deploy Service'
            inputs:
              azureSubscription: '${{ parameters.azureServiceConnection }}'
              appName: '$(serviceName)'
              package: '$(Pipeline.Workspace)/drop-app/archives/Service.zip'

I am trying to create a custom activity log alert rule, but no matter which method I try, it results in errors as below or the ARM template does not create the conditions specified even though its successful and cannot figure out what I need to do:

PowerShell code:

$RG = "Lab"
$location = 'Global'
$alertName = "Test Storage Account Administrative Operations"
$scope = "/subscriptions/[subID]/[RG]/providers/Microsoft.Storage/storageAccounts/staccountname"

$condition1 = New-AzActivityLogAlertCondition -Field 'Category' -Equal 'Administrative'
$condition2 = New-AzActivityLogAlertCondition -Field 'operationName' -Equal 'Microsoft.Storage/storageAccounts/blobServices/containers/write'

$dict = New-Object "System.Collections.Generic.Dictionary``2[System.String,System.String]"
$dict.Add('key1', 'Value1')
$actionGrp1 = New-AzActionGroup -ActionGroupId $actiongroupid -WebhookProperty $dict

set-AzActivityLogAlert -Location $location -Name $alertname -ResourceGroupName $rg -Scope $scope -Action $actionGrp1 -Condition $condition1, $condition2

PowerShell Error:

WARNING: 10:16:40 - *** The namespace for all the model classes will change from Microsoft.Azure.Management.Monitor.Management.Models to Microsoft.Azure.Management.Monitor.Models in future releases.
WARNING: 10:16:40 - *** The namespace for output classes will be uniform for all classes in future releases to make it independent of modifications in the model classes.
Set-AzActivityLogAlert: 
Line |
  12 |  set-AzActivityLogAlert -Location $location -Name $alertname -Resource …
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception type: ErrorResponseException, Message: Microsoft.Azure.Management.Monitor.Models.ErrorResponseException: Operation returned an invalid status code 'BadRequest'
   at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperations.CreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert, Dictionary`2 customHeaders, CancellationToken cancellationToken)
   at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.CreateOrUpdateAsync(IActivityLogAlertsOperations operations, String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert, CancellationToken cancellationToken)
   at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.CreateOrUpdate(IActivityLogAlertsOperations operations, String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert)     
   at Microsoft.Azure.Commands.Insights.ActivityLogAlert.SetAzureRmActivityLogAlertCommand.ProcessRecordInternal()
   at Microsoft.Azure.Commands.Insights.MonitorCmdletBase.ExecuteCmdlet(), Code: Null, Status code:Null, Reason phrase: Null

ARM template code:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "activityLogAlertName": {
            "defaultValue": "Test1",
            "type": "String",
            "metadata": {
                "description": "Unique name (within the Resource Group) for the Activity log alert."
            }
        },
        "activityLogAlertEnabled": {
            "defaultValue": true,
            "type": "Bool",
            "metadata": {
                "description": "Indicates whether or not the alert is enabled."
            }
        },
        "actionGroupResourceId": {
            "defaultValue": "/subscriptions/[subID]]/resourceGroups/FLab/providers/microsoft.insights/actionGroups/actiongroup2",
            "type": "String",
            "metadata": {
                "description": "Resource Id for the Action group."
            }
        },
        "condition1": {
            "defaultValue": "Administrative",
            "type": "String",
            "metadata": {
                "description": "condition value"
            }
        },
        "condition2": {
            "defaultValue": "Microsoft.Storage/storageAccounts/blobServices/containers/write",
            "type": "String",
            "metadata": {
                "description": "condition value"
            }
        },
        "condition3": {
            "defaultValue": "Microsoft.Storage/storageAccounts/blobServices/containers",
            "type": "String",
            "metadata": {
                "description": "condition value"
            }
        },
        "condition4": {
            "defaultValue": "Succeeded",
            "type": "String",
            "metadata": {
                "description": "condition value"
            }
        },
        "condition5": {
            "defaultValue": "Created",
            "type": "String",
            "metadata": {
                "description": "condition value"
            }
        }
    },
    "resources": [
        {
            "type": "Microsoft.Insights/activityLogAlerts",
            "apiVersion": "2017-04-01",
            "name": "[parameters('activityLogAlertName')]",
            "location": "Global",
            "properties": {
                "enabled": "[parameters('activityLogAlertEnabled')]",
                "scopes": [
                    "[subscription().id]"
                ],
                "condition": {
                    "allOf": [
                        {
                            "field": "Category",
                            "equals": "[parameters('condition1')]"
                        },
                        {
                            "field": "operationName",
                            "equals": "[parameters('condition2')]"
                        },
                        {
                            "field": "resourceType",
                            "equals": "[parameters('condition3')]"
                        },
                        {
                            "field": "Status",
                            "equals": "[parameters('condition4')]"
                        },
                        {
                            "field": "subStatus",
                            "equals": "[parameters('condition5')]"
                        }
                    ]
                },
                "actions": {
                    "actionGroups": [
                        {
                            "actionGroupId": "[parameters('actionGroupResourceId')]"
                        }
                    ]
                }
            }
        }
    ]
}

ARM template result:

Automation account runbook:

$RG = "Lab"
$location = 'Global'
$alertName = "Test Storage Account Administrative Operations"
$scope = "/subscriptions/[subID]/[RG]/providers/Microsoft.Storage/storageAccounts/staccountname"

$condition1 = New-AzActivityLogAlertCondition -Field 'Category' -Equal 'Administrative'
$condition2 = New-AzActivityLogAlertCondition -Field 'operationName' -Equal 'Microsoft.Storage/storageAccounts/blobServices/containers/write'

$dict = New-Object "System.Collections.Generic.Dictionary``2[System.String,System.String]"
$dict.Add('key1', 'Value1')
$actionGrp1 = New-AzActionGroup -ActionGroupId $actiongroupid -WebhookProperty $dict

set-AzActivityLogAlert -Location $location -Name $alertname -ResourceGroupName $rg -Scope $scope -Action $actionGrp1 -Condition $condition1, $condition2

Automation Account error:

10:27:45 AM - *** The namespace for all the model classes will change from 
Microsoft.Azure.Management.Monitor.Management.Models to Microsoft.Azure.Management.Monitor.Models in future releases.
10:27:45 AM - *** The namespace for output classes will be uniform for all classes in future releases to make it 
independent of modifications in the model classes.
set-AzActivityLogAlert : Exception type: MissingMethodException, Message: System.MissingMethodException: Method not 
found: 'System.String 
Microsoft.WindowsAzure.Commands.Utilities.Common.GeneralUtilities.GetLog(System.Net.Http.HttpRequestMessage)'.
   at Microsoft.Azure.Commands.ResourceManager.Common.ServiceClientTracingInterceptor.SendRequest(String invocationId, 
HttpRequestMessage request)
   at Microsoft.Rest.ServiceClientTracing.SendRequest(String invocationId, HttpRequestMessage request)
   at 
Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperations.<CreateOrUpdateWithHttpMessagesAsync>d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.<CreateOrUpdateAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at 
Microsoft.Azure.Management.Monitor.ActivityLogAlertsOperationsExtensions.CreateOrUpdate(IActivityLogAlertsOperations 
operations, String resourceGroupName, String activityLogAlertName, ActivityLogAlertResource activityLogAlert)
   at Microsoft.Azure.Commands.Insights.ActivityLogAlert.SetAzureRmActivityLogAlertCommand.ProcessRecordInternal()
   at Microsoft.Azure.Commands.Insights.MonitorCmdletBase.ExecuteCmdlet(), Code: Null, Status code:Null, Reason phrase: 
Null
At line:24 char:1
+ set-AzActivityLogAlert -Location $location -Name $alertname -Resource ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzActivityLogAlert], PSInvalidOperationException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Insights.ActivityLogAlert.SetAzureRmActivityLogAlertCommand

References:

set-azactivitylogalert method -

https://docs.microsoft.com/en-us/powershell/module/az.monitor/set-azactivitylogalert?view=azps-5.4.0

ARM template method -

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log#azure-resource-manager-template

Any help on this would be great!

I successfully deployed an app service plan, web application and application insights resources using an ARM Template. The APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING app settings have been added to the configuration/app settings.

The issue im noticing is that when I select the 'application insights' option in the menu I'm presented with 'Turn on Application Insights'. I thought adding the app settings above would turn on app insights but apparently not. Is it possible to enable app insights in an ARM Template? I'd like app insights to be enabled by default once the arm template deploys.

I was trying to configure Azure file share backup using ARM template deployment. Below is the template I'm trying to deploy. First I create a backup policy then trying to configure backup for the file share.

The question is, to the template I have to pass protected items in below format. (azurefileshare;someUniqueID) (I have to pass the unique protected item ID instead of file share name). But this ID can only be retrieved after configuring the backup.

Let me know if anyone here have any idea about this.

> "protectedItems": {
>             "value": [
>                 "azurefileshare;xxxx1f5e4535076cxxxxxxxxxxxb9ff558024ff8xxxxxxcefce6"
>             ]
> 

Tempate.json

 >  {
    > "$schema":"http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    > "contentVersion": "1.0.0.0",  
    >   "parameters": {
    >     "vaultName": {
    >       "type": "String"
    >     },
    >     "vaultRG": {
    >       "type": "String"
    >     },
    >     "vaultSubID": {
    >       "type": "String"
    >     },
    >     "policyName": {
    >       "type": "String"
    >     },
    >     "schedule": {
    >       "type": "Object"
    >     },
    >     "retention": {
    >       "type": "Object"
    >     },
    >     "timeZone": {
    >       "type": "String"
    >     },
    >     "fabricName": {
    >       "type": "String"
    >     },
    >     "protectionContainers": {
    >       "type": "Array"
    >     },
    >     "protectedItems": {
    >       "type": "Array"
    >     },
    >     "sourceResourceIds": {
    >       "type": "Array"
    >     }   },   "resources": [
    >     {
    >       "type": "Microsoft.RecoveryServices/vaults/backupPolicies",
    >       "apiVersion": "2016-06-01",
    >       "name": "[concat(parameters('vaultName'), '/', parameters('policyName'))]",
    >       "properties": {
    >         "backupManagementType": "AzureStorage",
    >         "WorkloadType": "AzureFileShare",
    >         "schedulePolicy": "[parameters('schedule')]",
    >         "retentionPolicy": "[parameters('retention')]",
    >         "TimeZone": "[parameters('timeZone')]"
    >       }
    >     },
    >     {
    >       "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
    >       "apiVersion": "2016-06-01",
    >       "name": "[concat(parameters('vaultName'), '/', parameters('fabricName'),
    > '/',parameters('protectionContainers')[copyIndex()], '/',
    > parameters('protectedItems')[copyIndex()])]",
    >       "dependsOn": [
    >         "[concat('Microsoft.RecoveryServices/vaults', '/', parameters('vaultName'), '/backupPolicies/',
    > parameters('policyName'))]"
    >       ],
    >       "properties": {
    >         "backupManagementType": "AzureStorage",
    >         "workloadType": "AzureFileShare",
    >         "friendlyName": "afs",
    >         "protectedItemType": "AzureFileShareProtectedItem",
    >         "policyId": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies',
    > parameters('vaultName'), parameters('policyName'))]",
    >         "sourceResourceId": "[parameters('sourceResourceIds')[copyIndex()]]"
    >       },
    >       "copy": {
    >         "name": "protectedItemsCopy",
    >         "count": "[length(parameters('protectedItems'))]"
    >       }
    >     }   ] }