Deploying Azure Database Watcher via IaC fails intermittently

Hi Daniel Rogers,

Thank you for clarifying that this is related to Azure Data Explorer cluster deployment. I apologize for the initial confusion with those questions they were intended for a different service. the problem is that when you enable restrictOutboundNetworkAccess, the cluster takes longer to fully set up, and Bicep tries to grab the output properties (dataIngestionUri and uri) before they are ready. That's why you get the error those properties only show up after the cluster is fully deployed.

The fix is simple: split your deployment into two steps. First, deploy the cluster. Then in a second deployment, reference the already-created cluster to grab the outputs. This way, everything's ready by the time you ask for those values.

Here's what to do:

text
// Second deployment file - run this AFTER the cluster is created
resource existingCluster 'Microsoft.Kusto/clusters@2024-04-13' existing = {
  name: clusterName
}

output clusterDataIngestionUri string = existingCluster.properties.dataIngestionUri
output clusterUri string = existingCluster.properties.uri
output clusterName string = existingCluster.name
output clusterResourceId string = existingCluster.id

Deploy the cluster first, then deploy this separate template for outputs. It will work every time without having to toggle settings.

Helpful References:

Restrict outbound access from Azure Data Explorer​

Microsoft.Kusto/clusters Bicep reference​

Azure Data Explorer cluster REST API​

Troubleshoot Bicep file deployments​

Please let us know if you have any questions and concerns.

Thanks Manoj, that did cross my mind but it's a bit clunky so was hoping to avoid it, but thank you for clarifying that's the best way forward - I'll give it a shot today. I've re-jigged it like this:

@description('Required. The Azure Data Explorer (ADX) cluster name.')
param clusterName string

resource existingCluster 'Microsoft.Kusto/clusters@2024-04-13' existing = {
  name: clusterName
}

output clusterDataIngestionUri string = existingCluster.properties.dataIngestionUri
output clusterName string = existingCluster.name
output clusterResourceId string = existingCluster.id
output clusterUri string = existingCluster.properties.uri

module adxClusterOutputs './adxClusterOutputs.bicep' = {
  params: {
    clusterName: adxClusterName
  }
  dependsOn: [
    adxCluster // cluster creation module
  ]
}

Hello Daniel Rogers,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are deploying Azure Database Watcher via IaC fails intermittently.

Reading through all the above, among many things observed; an assumption that support exists in Terraform/ARM/AzAPI is misleading, since Terraform implementation was missing. - https://github.com/hashicorp/terraform-provider-azurerm/issues/28051 and possible misuse of ARM by passing boolean as string (see same common error example - https://stackoverflow.com/questions/65492839/deploying-arm-template-with-terraform-results-in-datatype-mismatch).

Best practices I will suggest if you must use Terraform today:

• Option 1: Use ARM Template deployment with azurerm_template_deployment to ensure you’re using apiVersion: "2025-01-02-preview" (or later)- https://learn.microsoft.com/en-us/azure/templates/microsoft.databasewatcher/watchers and https://github.com/MicrosoftDocs/sql-docs/blob/live/azure-sql/database-watcher-overview.md gives more insight to this.
  • Then, pass boolean values correctly (no string values) - https://stackoverflow.com/questions/65492839/deploying-arm-template-with-terraform-results-in-datatype-mismatch for an example:

    "identity": { "type": "SystemAssigned,UserAssigned", "userAssignedIdentities": {} },
            "properties": {
              "datastore": {
                "adxClusterResourceId": ...,
                "kustoClusterUri": ...,
                "kustoDatabaseName": ...,
                "kustoManagementUrl": ...,
                "kustoDataIngestionUri": ...,
                "kustoOfferingType": ...
              },
              "defaultAlertRuleIdentityResourceId": "userAssignedIdentityResourceId"
            }
  

  • Double-check apiVersion matches what documentation references - https://learn.microsoft.com/en-us/azure/templates/microsoft.databasewatcher/watchers and https://github.com/MicrosoftDocs/sql-docs/blob/live/azure-sql/database-watcher-overview.md show more details.
• Option 2: Wait for official azurerm_database_watcher support by tracking Terraform GH issue (#28051) - https://github.com/hashicorp/terraform-provider-azurerm/issues/28051

Secondly, if you prefer Bicep or ARM:

• Align schema with documentation here - https://learn.microsoft.com/en-us/azure/templates/microsoft.databasewatcher/watchers and https://github.com/MicrosoftDocs/sql-docs/blob/live/azure-sql/database-watcher-overview.md
• Validate identity.type and userAssignedIdentities use correct format - as it's been mentioned here - https://learn.microsoft.com/en-us/azure/templates/microsoft.databasewatcher/watchers

Thirdly, for successful troubleshooting tips:

1. Use Azure CLI or Portal to manually create a Database Watcher with same parameters to capture working JSON, then replicate via IaC.
2. Check all nested types (type: int, bool, string).
3. Use the Azure REST API: GET /subscriptions/.../watchers?api-version=2025-01-02-preview to test validity.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.