Cortex Cloud: Azure Onboarding Errors via Terraform

• Terraform state reflected an Event Hub resource despite its deletion from Azure.
• Terraform operations failed with resource conflict and not found errors for Azure services during XSIAM onboarding.

**ERROR_LOGS**
• Error: A resource with the ID "/subscriptions/.../resourceGroups/.../eventhubs/..." already exists - to be managed via Terraform, this resource needs to be imported into the State.
• Error: diagnosticsettings.DiagnosticSettingsClient#Get: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="ResourceNotFound" Message="The diagnostic setting 'CortexMonitorDiagnosticSettings-...' doesn't exist."

**Product_versions**
• Cortex Cloud: 2.1

Onboarding Method: Terraform

Mismatched state between Terraform's desired configuration and existing Azure resources. An Azure Event Hub resource that Terraform attempted to create already existed, and a required diagnostic settings resource was not found in Azure, even though Terraform expected to interact with it.

**REMEDIATION_PLAN**
1. Manually deleted the conflicting pre-existing Azure Event Hub resource.
2. Performed a re-onboarding process using a new template provided from the Cortex Console to integrate the Azure Account successfully.

To resolve the following error: 

• Error: A resource with the ID "/subscriptions/.../resourceGroups/.../eventhubs/..." already exists - to be managed via Terraform this resource needs to be imported into the State.

Needs to run the following command in Azure before running the Terraform apply command.

terraform import -var-file="template_params.tfvars" \

  'azurerm_monitor_diagnostic_setting.cortex_subscription_diagnostic_setting' \

  "/subscriptions/<Azure-Subscription-Id>|<Cortex-Monitor-Diagnostic-Settings-Name>"

Note: to find the "Cortex-Monitor-Diagnostic-Settings-Name" > go to Azure Console > Subscriptions > Choose the subscription which you have onboarded on Cortex Cloud > Resource groups > Activity Logs > Export Activity Logs > Cortex Monitor Diagnostic Name

N/A