From ee31106e2805dd7d70b5394e3427fd84a08b5da8 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Tue, 28 Apr 2026 22:56:27 +0200 Subject: [PATCH] docs(security/azure): fix post-apply recipe (Consumption SKU) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The header comment in scheduled-tasks.tf told operators to inspect the deployed workflow with `az logicapp show`, but `az logicapp` targets Logic Apps Standard (`Microsoft.Web/sites` with `kind=workflowapp`). These workflows are Consumption-tier (`Microsoft.Logic/workflows` via `azurerm_logic_app_workflow`); running `az logicapp show -n ` against one returns ResourceNotFound. Replace with `az resource show --resource-type Microsoft.Logic/workflows --api-version 2019-05-01`, which works against the right SKU and needs no cli extensions (`az logic workflow show` does, and that extension can fail to install on Python 3.12+ azure-cli builds). Comment-only — no resource, state, or runtime change. Refs #183. --- .../compute/azure/container-apps/scheduled-tasks.tf | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/terraform/modules/compute/azure/container-apps/scheduled-tasks.tf b/terraform/modules/compute/azure/container-apps/scheduled-tasks.tf index c54b819a2..4efe5e564 100644 --- a/terraform/modules/compute/azure/container-apps/scheduled-tasks.tf +++ b/terraform/modules/compute/azure/container-apps/scheduled-tasks.tf @@ -10,9 +10,15 @@ # user-assigned identity, and the call-endpoint action references # `@body('get-secret')['value']` in the outgoing Authorization header. # -# Effect: `terraform show` / `az logicapp show` only ever reveal the Key Vault -# URL the workflow is going to call — the actual secret value is fetched -# in-process by the Logic Apps engine and never lands in any persisted artifact. +# Effect: `terraform show` / `az resource show --resource-type +# Microsoft.Logic/workflows --api-version 2019-05-01 -g -n ` only ever +# reveal the Key Vault URL the workflow is going to call — the actual secret +# value is fetched in-process by the Logic Apps engine and never lands in any +# persisted artifact. Note: `az logicapp show` is for Logic Apps Standard +# (`Microsoft.Web/sites`); these workflows are Consumption-tier +# (`Microsoft.Logic/workflows`), and `az logic workflow show` requires the +# `logic` cli extension which can fail to install in some environments — +# `az resource show` works without extensions. See issue #183. # Parse cron schedule into Logic Apps recurrence format # Azure Logic Apps uses a different format than cron