[AVM Module Issue]: adding LAW requires a shared key, which is not required when using the resource directly

[kewalaka]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Module specific issue

• I confirm that this issue is about this AVM module and not about the resource itself, or how to use Terraform.

Issue Type?

Feature Request

(Optional) Module Version

0.1.2

(Optional) Correlation Id

No response

Description

When specifying log analytics, it is necessary to specify both the customer ID and customer key.

This is because we are using AzAPI under the hood, and that appears to be the requirement there

https://learn.microsoft.com/en-us/azure/templates/microsoft.app/managedenvironments?pivots=deployment-language-terraform#loganalyticsconfiguration-2

It is not clear from the docs if the key is optional

By comparison, when using AzureRM, only the workspace ID is required:

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_app_environment#log_analytics_workspace_id

This is preferable, as it avoids have to fetch & pass the LAW key.

[kewalaka]

have a fix in testing (linked above) that i'm hoping will address this.

[ajeetchouksey]

Would like to know the current status. Module still requires Shared Key.

[kewalaka]

I'm not sure how to approach this. The advantage of using the key is (I think!) it avoids having to have any permission on the LAW, which may be useful in some environments where this is centralised.

What I'm considering at the moment is to keep the existing approach but optionally add the ability to do it via the resource ID as well, which I believe would then require Microsoft.OperationalInsights/workspaces/sharedkeys/read at least over the target LAW.

A lot of the trivial examples don't consider LAWs in centralised subscriptions.

I haven't had chance to test the above out yet - any feedback gratefully received.

[ajeetchouksey]

As a workaround (to prevent from confusion) , I recommend making the log_analytics_workspace_primary_shared_key a mandatory input in https://registry.terraform.io/modules/Azure/avm-res-app-managedenvironment/azurerm/latest?tab=inputs. This change will help prevent any potential confusion.

Additionally, please update the following in the https://github.com/Azure/terraform-azurerm-avm-res-app-managedenvironment/blob/main/variables.tf:

variable "log_analytics_workspace_primary_shared_key" {
type = string
//default = null
description = "Primary shared key for Log Analytics."
}

Let me know if its ok with you. I can do a fork and Submit the PR