ASC (MDFC) export to Azure Monitor is not reliable due to DINE policy race condition

[matt-FFFFFF]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Versions

terraform: 1.2.2

azure provider: 3.20

module: 3.1.2

Description

Describe the bug

MDFC export to LAW policy does not enable the functionality due to race condition.

Steps to Reproduce

1. Deploy default architecture with configure_management_resources
2. Observe subscription MDFC continuous export configuration not correct
3. Observe Deploy-MDFC-Config policy not compliant

Screenshots

Additional context

Recommend declaring azurerm_security_center_automation resource to prevent this happening.

[jtracey93]

Trigger ADO Sync

[krowlandson]

@matt-FFFFFF... We can implement this for the connectivity and management Subscriptions as we have providers configured for these, but not for any others.

Are you proposing we implement this in conjunction with future integrations between this module and lz-vending?

[krowlandson]

Trigger ADO Sync

[matt-FFFFFF]

Azure/terraform-azurerm-lz-vending#136 is the lz-vending issue

[matt-FFFFFF]

AB#26868