Azure Logic App Standards

# Consumption (Microsoft.Logic/workflows) and Standard (Microsoft.Web/sites)
logic-{infix}-{outfix}-{suffix}-{numbering}
logic-ldo-uks-prd-01
logic-ldo-uks-dev-01
logic-ldo-uks-prd-02

# Terraform
tags = {
  hidden-title = "Sentinel Incident - Enrich and notify Teams on High severity"
  environment  = "prd"
  managed-by   = "terraform"
  module       = "terraform-azurerm-logic-app"
}

Trigger
└── Condition: triggerBody()?['object']?['properties']?['status'] is not equal to 'Closed'
    ├── True: continue with automation
    └── False: Terminate (Cancelled)

# Filter to creation events only (avoid re-triggering on enrichment updates):
triggerOutputs()?['body']?['object']?['properties']?['additionalData']?['alertsCount'] > 0

# Filter by severity:
triggerBody()?['object']?['properties']?['severity'] equals 'High'

# Filter by specific analytic rule:
contains(triggerBody()?['object']?['properties']?['title'], 'Brute Force')

Sentinel → Automation rules → + Create
  Trigger: When incident is created
  Conditions: Severity = High
  Actions: Run playbook → select your Logic App

{
  "type": "Request",
  "kind": "Http",
  "inputs": {
    "schema": {
      "type": "object",
      "properties": {
        "alertId": { "type": "string" },
        "severity": { "type": "string", "enum": ["High", "Medium", "Low"] },
        "description": { "type": "string" }
      },
      "required": ["alertId", "severity"]
    }
  }
}

Request trigger
└── Response action (immediately): HTTP 202 Accepted
└── [rest of workflow runs async]

{
  "type": "Recurrence",
  "recurrence": {
    "frequency": "Day",
    "interval": 1,
    "schedule": {
      "hours": ["06"],
      "minutes": [0]
    },
    "timeZone": "GMT Standard Time"
  }
}

Recurrence trigger (every 1 hour)
└── Azure Monitor Logs: Run query and list results
    ├── Subscription: [your subscription]
    ├── Resource Group: [Log Analytics RG]
    ├── Resource Type: Log Analytics Workspace
    ├── Resource Name: [workspace name]
    └── Query:
        SecurityEvent
        | where TimeGenerated > ago(1h)
        | where EventID == 4625
        | summarize FailCount = count() by TargetAccount, IpAddress
        | where FailCount > 20
└── Condition: length(body('Run_query_and_list_results')?['value']) > 0
    ├── True: For each result → [send Teams notification / create incident]
    └── False: Terminate (Succeeded)

Recurrence trigger (every 5 minutes)
└── [Connector]: Get new items since last run
    ├── Use a timestamp variable initialised on first run
    └── Update the timestamp at the end of each successful run
└── Condition: has items
    ├── True: process each item
    └── False: Terminate (Succeeded)

resource "azurerm_logic_app_standard" "this" {
  name                = "logic-ldo-uks-prd-01"
  resource_group_name = var.rg_name
  location            = var.location
  # ...
 
  identity {
    type = "SystemAssigned"
  }
}
 
# Role assignment targets the Logic App's own identity
resource "azurerm_role_assignment" "sentinel_responder" {
  scope                = var.sentinel_workspace_resource_id
  role_definition_name = "Microsoft Sentinel Responder"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
 
  depends_on = [azurerm_logic_app_standard.this]
}

# Shared identity - created once, attached to all playbooks in the suite
resource "azurerm_user_assigned_identity" "sentinel_playbooks" {
  name                = "id-sentinel-playbooks-ldo-uks-prd-01"
  resource_group_name = var.rg_name
  location            = var.location
  tags                = var.tags
}
 
# Role assignments made once on the shared identity
resource "azurerm_role_assignment" "sentinel_responder" {
  scope                = var.sentinel_workspace_resource_id
  role_definition_name = "Microsoft Sentinel Responder"
  principal_id         = azurerm_user_assigned_identity.sentinel_playbooks.principal_id
}
 
resource "azurerm_role_assignment" "law_reader" {
  scope                = azurerm_log_analytics_workspace.this.id
  role_definition_name = "Log Analytics Reader"
  principal_id         = azurerm_user_assigned_identity.sentinel_playbooks.principal_id
}
 
# All playbooks in the suite use the shared identity.
# Use "this" as the resource label - for_each provides the per-instance key.
locals {
  sentinel_playbook_names = toset([
    "logic-ldo-uks-prd-01",
    "logic-ldo-uks-prd-02",
  ])
}
 
resource "azurerm_logic_app_standard" "this" {
  for_each = local.sentinel_playbook_names
 
  name                = each.key
  resource_group_name = var.rg_name
  location            = var.location
  # ...
 
  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.sentinel_playbooks.id]
  }
}
 
# Access individual instances via the for_each key:
# azurerm_logic_app_standard.this["logic-ldo-uks-prd-01"]

app_settings = {
  "SENTINEL_CLIENT_ID"     = var.sentinel_sp_client_id
  "SENTINEL_CLIENT_SECRET" = "@Microsoft.KeyVault(VaultName=${var.kv_name};SecretName=sentinel-sp-secret)"
  "SENTINEL_TENANT_ID"     = var.tenant_id
}

# terraform.tf - add azapi alongside azurerm
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 4.0.0, < 5.0.0"
    }
    azapi = {
      source  = "azure/azapi"
      version = ">= 2.0.0, < 3.0.0"
    }
  }
}

# Create the managed API connection
# parameterValueType = "Alternative" enables managed identity auth on the connection
resource "azapi_resource" "sentinel_connection" {
  type      = "Microsoft.Web/connections@2016-06-01"
  name      = "conn-sentinel-ldo-uks-prd-01"
  location  = var.location
  parent_id = "/subscriptions/${var.subscription_id}/resourceGroups/${var.rg_name}"
 
  body = {
    properties = {
      displayName        = "Microsoft Sentinel - Managed Identity"
      parameterValueType = "Alternative"
      api = {
        id = "/subscriptions/${var.subscription_id}/providers/Microsoft.Web/locations/${var.location}/managedApis/azuresentinel"
      }
    }
  }
 
  response_export_values = ["*"]
}
 
# Create the Microsoft Teams connection
resource "azapi_resource" "teams_connection" {
  type      = "Microsoft.Web/connections@2016-06-01"
  name      = "conn-teams-ldo-uks-prd-01"
  location  = var.location
  parent_id = "/subscriptions/${var.subscription_id}/resourceGroups/${var.rg_name}"
 
  body = {
    properties = {
      displayName        = "Microsoft Teams - Managed Identity"
      parameterValueType = "Alternative"
      api = {
        id = "/subscriptions/${var.subscription_id}/providers/Microsoft.Web/locations/${var.location}/managedApis/teams"
      }
    }
  }
 
  response_export_values = ["*"]
}
 
# Grant the Logic App's managed identity access to the Sentinel connection
# This access policy is what allows the Logic App to use the connection at runtime
resource "azapi_resource" "sentinel_connection_access_policy" {
  type      = "Microsoft.Web/connections/accessPolicies@2016-06-01"
  name      = azurerm_logic_app_standard.this.name
  parent_id = azapi_resource.sentinel_connection.id
  location  = var.location
 
  body = {
    properties = {
      principal = {
        type = "ActiveDirectory"
        identity = {
          objectId = azurerm_logic_app_standard.this.identity[0].principal_id
          tenantId = var.tenant_id
        }
      }
    }
  }
 
  depends_on = [
    azapi_resource.sentinel_connection,
    azurerm_logic_app_standard.this,
    azurerm_role_assignment.sentinel_responder,   # role must exist before the connection is used
  ]
}
 
resource "azapi_resource" "teams_connection_access_policy" {
  type      = "Microsoft.Web/connections/accessPolicies@2016-06-01"
  name      = azurerm_logic_app_standard.this.name
  parent_id = azapi_resource.teams_connection.id
  location  = var.location
 
  body = {
    properties = {
      principal = {
        type = "ActiveDirectory"
        identity = {
          objectId = azurerm_logic_app_standard.this.identity[0].principal_id
          tenantId = var.tenant_id
        }
      }
    }
  }
 
  depends_on = [
    azapi_resource.teams_connection,
    azurerm_logic_app_standard.this,
  ]
}

{
  "parameters": {
    "$connections": {
      "value": {
        "azuresentinel": {
          "connectionId": "/subscriptions/.../resourceGroups/.../providers/Microsoft.Web/connections/conn-sentinel-ldo-uks-prd-01",
          "connectionName": "conn-sentinel-ldo-uks-prd-01",
          "connectionProperties": {
            "authentication": {
              "type": "ManagedServiceIdentity"
            }
          },
          "id": "/subscriptions/.../providers/Microsoft.Web/locations/uksouth/managedApis/azuresentinel"
        }
      }
    }
  }
}

resource "azurerm_logic_app_standard" "this" {
  for_each = local.logic_app_map
  # ...
  virtual_network_subnet_id = var.integration_subnet_id   # /28 minimum, /26 recommended
}

resource "azurerm_private_endpoint" "this" {
  for_each = local.logic_app_map
 
  # Convention: pep-{resource_name} - the protected resource name already contains
  # the environment and region, so no suffix is added.
  name                = "pep-${each.key}"
  resource_group_name = var.rg_name
  location            = var.location
  subnet_id           = var.private_endpoint_subnet_id
 
  private_service_connection {
    name                           = "psc-${each.key}"
    private_connection_resource_id = azurerm_logic_app_standard.this[each.key].id
    subresource_names              = ["sites"]
    is_manual_connection           = false
  }
}

# Get outbound IPs via CLI
az webapp show \
  --name logic-ldo-uks-prd-01 \
  --resource-group rg-ldo-uks-prd-01 \
  --query outboundIpAddresses -o tsv

Inbound:
  Allow: Azure Logic Apps service tag → subnet (for platform health checks)

Outbound:
  Allow: subnet → Log Analytics workspace (AzureMonitor service tag) - for diagnostics
  Allow: subnet → Key Vault private endpoint (port 443)
  Allow: subnet → Storage account (Azure Storage service tag) - Standard stateful storage
  Allow: subnet → external services (specific IPs/FQDNs per integration)
  Deny: all other outbound

{
  "type": "ApiConnection",
  "inputs": { "...": "..." },
  "runAfter": {},
  "runtimeConfiguration": {
    "staticResult": { "name": "...", "staticResultOptions": "Disabled" }
  },
  "operationOptions": "DisableAsyncPattern",
  "retryPolicy": {
    "type": "exponential",
    "count": 4,
    "interval": "PT7.5S",
    "minimumInterval": "PT5S",
    "maximumInterval": "PT1H"
  }
}

Action: Call External API
├── Run After: preceding step succeeded
├── On Success: continue
└── On Failure / Timeout / Skipped:
    └── Scope: Error Handler
        ├── Send Teams alert: "Logic App {{workflow().name}} failed at {{actions('Call_External_API').startTime}}"
        ├── Add Sentinel incident comment: "Automation failed - manual review required"
        └── Terminate: Failed (with descriptive error message)

Scope: Main Workflow
  ├── [all your workflow actions]
  └── runs on: succeeded

Scope: Error Handler
  ├── runs on: Main Workflow failed OR timed out OR skipped
  ├── Send failure notification
  ├── Optionally: Update Sentinel incident status to "In Progress" with comment
  └── Terminate action: Failed

On success:
  Sentinel: Add comment to incident
    Comment: "Playbook completed successfully. [Summary of actions taken]."
  Sentinel: Update incident status (if appropriate: Closed/Active)

On failure:
  Sentinel: Add comment to incident
    Comment: "⚠️ Playbook failed at step [action name]. Error: [error message]. Manual review required."
  Do NOT close or change the incident status - leave it for human review

1. HTTP request → Logic App HTTP trigger
2. Logic App responds immediately: 202 Accepted + Location header (status endpoint URL)
3. Caller polls the status URL
4. Logic App updates a Storage Table with run status
5. Status endpoint returns 200 OK when complete

# terraform.tf
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 4.0.0, < 5.0.0"
    }
    azapi = {
      source  = "azure/azapi"
      version = ">= 2.0.0, < 3.0.0"
    }
  }
}
 
# main.tf
module "logic_apps" {
  source = "github.com/libre-devops/terraform-azurerm-logic-app"
 
  location = var.location
  rg_name  = azurerm_resource_group.this.name
 
  logic_apps = [
    {
      name                       = "logic-ldo-uks-prd-01"
      app_service_plan_name      = "plan-ldo-uks-prd-01"
      os_type                    = "Linux"
      sku_name                   = "WS1"
      storage_account_name       = azurerm_storage_account.logic_app.name
      storage_account_access_key = azurerm_storage_account.logic_app.primary_access_key
      https_only                 = true
      enabled                    = true
      identity_type              = "SystemAssigned"
      public_network_access      = "Disabled"
      virtual_network_subnet_id  = azurerm_subnet.integration.id
 
      app_settings = {
        "APPINSIGHTS_INSTRUMENTATIONKEY"        = azurerm_application_insights.this.instrumentation_key
        "APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.this.connection_string
        "WEBSITE_RUN_FROM_PACKAGE"              = "1"
      }
 
      site_config = {
        always_on       = true
        min_tls_version = "1.2"
        ftps_state      = "Disabled"
        http2_enabled   = true
      }
 
      tags = {
        hidden-title = "Sentinel Incident - Enrich and notify Teams on High severity"
        environment  = var.environment
        managed-by   = "terraform"
        owner        = "platform-team"
        cost-centre  = "sec-ops"
      }
    }
  ]
 
  tags = var.tags
}

# App Service Plan - written directly when the module's plan configuration is insufficient
resource "azurerm_service_plan" "this" {
  name                = "plan-ldo-uks-prd-01"
  resource_group_name = azurerm_resource_group.this.name
  location            = var.location
  os_type             = "Linux"
  sku_name            = "WS2"
 
  # Example custom requirement: zone balancing enabled - not exposed by the module
  zone_balancing_enabled = true
 
  tags = var.tags
}
 
# Logic App - written directly
resource "azurerm_logic_app_standard" "this" {
  name                       = "logic-ldo-uks-prd-01"
  resource_group_name        = azurerm_resource_group.this.name
  location                   = var.location
  app_service_plan_id        = azurerm_service_plan.this.id
  storage_account_name       = azurerm_storage_account.logic_app.name
  storage_account_access_key = azurerm_storage_account.logic_app.primary_access_key
  https_only                 = true
  enabled                    = true
  public_network_access      = "Disabled"
  virtual_network_subnet_id  = azurerm_subnet.integration.id
 
  app_settings = {
    "APPINSIGHTS_INSTRUMENTATIONKEY"        = azurerm_application_insights.this.instrumentation_key
    "APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.this.connection_string
    "WEBSITE_RUN_FROM_PACKAGE"              = "1"
    # Custom: reference a secret that only this Logic App needs
    "DOWNSTREAM_API_KEY" = "@Microsoft.KeyVault(VaultName=${azurerm_key_vault.this.name};SecretName=downstream-api-key)"
  }
 
  identity {
    type = "SystemAssigned"
  }
 
  site_config {
    always_on       = true
    min_tls_version = "1.2"
    ftps_state      = "Disabled"
    http2_enabled   = true
  }
 
  # Custom lifecycle: prevent accidental destroy in production
  lifecycle {
    prevent_destroy = true
    ignore_changes  = [app_settings["WEBSITE_RUN_FROM_PACKAGE"]]
  }
 
  tags = merge(var.tags, {
    hidden-title = "HTTP - Receive GitHub webhook and create JIRA ticket"
  })
 
  # The Key Vault must be accessible before the Logic App can start up and read its secrets
  depends_on = [
    azurerm_role_assignment.kv_secrets_user,
    azurerm_subnet.integration,
  ]
}

resource "azurerm_logic_app_trigger_http_request" "http_trigger" {
  name         = "When_HTTP_request_is_received"
  logic_app_id = azurerm_logic_app_standard.this.id
  
  # Schema validates incoming request body - required
  schema = jsonencode({
    type       = "object"
    properties = {
      incident_id = {
        type        = "string"
        description = "Sentinel incident ID"
      }
      severity = {
        type        = "string"
        enum        = ["Low", "Medium", "High", "Critical"]
        description = "Incident severity level"
      }
      payload = {
        type       = "object"
        properties = {
          assets = { type = "array" }
          tags   = { type = "object" }
        }
      }
    }
    required = ["incident_id", "severity"]
  })
  
  method = "POST"
}

resource "azurerm_logic_app_trigger_recurrence" "schedule_trigger" {
  name         = "Recurrence_daily_enrichment"
  logic_app_id = azurerm_logic_app_standard.this.id
  
  frequency  = "Day"
  interval   = 1
  start_time = "2024-01-01T08:00:00Z"  # UTC only
  time_zone  = "UTC"
  
  # Optional: restrict to business days
  schedule {
    days_of_week = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday"]
  }
}

# First, ensure the Sentinel connection exists (managed separately).
# Look up the managed API by name instead of hand-assembling its resource ID.
data "azurerm_managed_api" "sentinel" {
  name     = "azuresentinel"
  location = var.location
}
 
resource "azurerm_api_connection" "sentinel" {
  name                = "sentinel-${var.environment}"
  resource_group_name = azurerm_resource_group.this.name
  managed_api_id      = data.azurerm_managed_api.sentinel.id
}
 
# Sentinel trigger definition
resource "azurerm_logic_app_trigger_custom" "sentinel_incident" {
  name         = "When_Azure_Sentinel_incident_is_created_or_updated"
  logic_app_id = azurerm_logic_app_standard.this.id
  
  body = jsonencode({
    inputs = {
      host = {
        connection = {
          name = azurerm_api_connection.sentinel.id
        }
      }
      path = "/incident"
      queries = {
        # Filter by severity - do not hardcode
        "triggerBody()?['object']?['properties']?['severity']" = "High,Critical"
      }
    }
  })
}
 
# Example: Later action referencing the trigger
resource "azurerm_logic_app_action_custom" "enrich_incident" {
  name         = "Enrich_from_watchlist"
  logic_app_id = azurerm_logic_app_standard.this.id
  
  # Use Terraform-evaluated watchlist ID, not hardcoded string
  body = jsonencode({
    inputs = {
      watchlist_id = azurerm_sentinel_watchlist.threat_actors.immutable_id
      incident_id  = "@{triggerBody()?['object']?['id']}"
      severity     = "@{triggerBody()?['object']?['properties']?['severity']}"
    }
  })
  
  depends_on = [azurerm_logic_app_trigger_custom.sentinel_incident]
}

# Service Bus connection
data "azurerm_managed_api" "service_bus" {
  name     = "servicebus"
  location = var.location
}
 
resource "azurerm_api_connection" "service_bus" {
  name                = "servicebus-${var.environment}"
  resource_group_name = azurerm_resource_group.this.name
  managed_api_id      = data.azurerm_managed_api.service_bus.id
}
 
# Queue trigger - references queue name from Terraform variable
resource "azurerm_logic_app_trigger_custom" "service_bus_trigger" {
  name         = "Service_Bus_message_incident_queue"
  logic_app_id = azurerm_logic_app_standard.this.id
  
  body = jsonencode({
    inputs = {
      host = {
        connection = {
          name = azurerm_api_connection.service_bus.id
        }
      }
      method = "GET"
      path   = "/queue/@{encodeURIComponent('${var.incident_queue_name}')}/messages"
      queries = {
        "maxMessagesToReturn" = 1
        "isSessionEnabled"    = false
      }
    }
  })
}

# Event Grid connection
data "azurerm_managed_api" "event_grid" {
  name     = "azureeventgrid"
  location = var.location
}
 
resource "azurerm_api_connection" "event_grid" {
  name                = "eventgrid-${var.environment}"
  resource_group_name = azurerm_resource_group.this.name
  managed_api_id      = data.azurerm_managed_api.event_grid.id
}
 
# Event Grid trigger - blob storage events
resource "azurerm_logic_app_trigger_custom" "event_grid_trigger" {
  name         = "Event_Grid_blob_created"
  logic_app_id = azurerm_logic_app_standard.this.id
  
  body = jsonencode({
    inputs = {
      host = {
        connection = {
          name = azurerm_api_connection.event_grid.id
        }
      }
      # Reference storage account from Terraform - do not hardcode
      path = "/subscriptions/@{encodeURIComponent('${data.azurerm_client_config.current.subscription_id}')}/resourceGroups/@{encodeURIComponent('${azurerm_resource_group.this.name}')}/providers/Microsoft.Storage/storageAccounts/@{encodeURIComponent('${azurerm_storage_account.logs.name}')}/events"
      queries = {
        # Filter to blob created events only
        "api-version" = "2017-09-15-preview"
      }
    }
    schema = {
      type       = "object"
      properties = {
        eventType = {
          type = "string"
          enum = ["Microsoft.Storage.BlobCreated"]
        }
        data = {
          type = "object"
          properties = {
            url = { type = "string" }
          }
        }
      }
    }
  })
}

# Trigger - entry point, no depends_on
resource "azurerm_logic_app_trigger_recurrence" "daily_scan" {
  name         = "Recurrence_daily_threat_hunt"
  logic_app_id = azurerm_logic_app_standard.this.id
  frequency    = "Day"
  interval     = 1
  start_time   = "2024-01-01T09:00:00Z"
  time_zone    = "UTC"
}
 
# Action - depends on trigger via trigger body
resource "azurerm_logic_app_action_http" "kql_query" {
  name         = "HTTP_execute_kql_query"
  logic_app_id = azurerm_logic_app_standard.this.id
  method       = "POST"
  # Host is the shared api.loganalytics.io endpoint; the path takes the workspace
  # GUID (customer ID) from .workspace_id, NOT the full ARM resource .id.
  uri          = "https://api.loganalytics.io/v1/workspaces/${azurerm_log_analytics_workspace.this.workspace_id}/query"
  
  depends_on = [azurerm_logic_app_trigger_recurrence.daily_scan]
}
 
# Action - depends on previous action
resource "azurerm_logic_app_action_custom" "parse_results" {
  name         = "Parse_KQL_results"
  logic_app_id = azurerm_logic_app_standard.this.id
  # ...
  depends_on = [azurerm_logic_app_action_http.kql_query]
}

resource "azurerm_logic_app_action_custom" "initialize_variables" {
  name                    = "Initialize_variables"
  logic_app_id            = azurerm_logic_app_standard.this.id
  
  # type = "InitializeVariable" makes this a variable-init action, not an HTTP call.
  body = jsonencode({
    type = "InitializeVariable"
    inputs = {
      variables = [
        {
          name  = "incident_id"
          type  = "String"
          value = "@{triggerBody()?['object']?['id']}"
        },
        {
          name  = "severity"
          type  = "String"
          value = "@{triggerBody()?['object']?['properties']?['severity']}"
        },
        {
          name  = "enrichment_api_key"
          type  = "String"
          # Reference Key Vault secret - never hardcode API keys
          value = "@{parameters('enrichment_api_key')}"
        }
      ]
    }
    runAfter = {}
  })
}

# Store API endpoint in variable (can change per environment)
variable "enrichment_api_endpoint" {
  type = string
  default = "https://api.example.com/incidents/enrich"
}
 
resource "azurerm_logic_app_action_http" "webhook_call" {
  name                    = "HTTP_webhook_enrichment"
  logic_app_id            = azurerm_logic_app_standard.this.id
  method                  = "POST"
  uri                     = var.enrichment_api_endpoint  # From Terraform variable
  headers = {
    "Content-Type"      = "application/json"
    "Authorization"     = "Bearer @{parameters('enrichment_api_key')}"  # From Key Vault
    "X-Request-ID"      = "@{guid()}"  # Unique request ID for tracking
  }
  
  body = jsonencode({
    incident_id = "@{variables('incident_id')}"
    severity    = "@{variables('severity')}"
    # Include enrichment context - reference from watchlist via Terraform
    threat_intel_source = var.threat_intel_watchlist_name
  })
  
  depends_on = [azurerm_logic_app_action_custom.initialize_variables]
}

# First, register the connector (manages authentication)
data "azurerm_managed_api" "jira" {
  name     = "jira"
  location = var.location
}
 
resource "azurerm_api_connection" "jira" {
  name                = "jira-${var.environment}"
  resource_group_name = azurerm_resource_group.this.name
  managed_api_id      = data.azurerm_managed_api.jira.id
}
 
# Then use in custom action - reference connector and store project key as variable
variable "jira_security_project_key" {
  type    = string
  default = "SEC"
}
 
resource "azurerm_logic_app_action_custom" "create_jira_ticket" {
  name             = "JIRA_create_issue"
  logic_app_id     = azurerm_logic_app_standard.this.id
  
  body = jsonencode({
    inputs = {
      host = {
        connection = {
          name = azurerm_api_connection.jira.id
        }
      }
      method   = "post"
      path     = "/rest/api/3/issues"
      queries = {
        # Project key from Terraform variable
        projectKey = var.jira_security_project_key
      }
      body = {
        fields = {
          summary     = "@{variables('incident_id')} - @{variables('severity')}"
          description = "@{body('HTTP_webhook_enrichment')?['description']}"
          issuetype = {
            # Map severity to issue type
            name = "@{if(equals(variables('severity'), 'Critical'), 'Security Incident', 'Task')}"
          }
          # Reference custom field from Terraform if needed
          customfield_10000 = var.jira_incident_priority_field_id
        }
      }
    }
    runAfter = {
      "HTTP_webhook_enrichment" = ["Succeeded"]
    }
  })
  
  depends_on = [azurerm_logic_app_action_http.webhook_call]
}

# Try block - enrichment operations
resource "azurerm_logic_app_action_custom" "scope_enrichment" {
  name         = "Scope_enrichment"
  logic_app_id = azurerm_logic_app_standard.this.id
 
  # A Scope is a single custom action whose body nests its child actions
  # under "actions". type = "Scope" is what makes it a scope, not an HTTP call.
  body = jsonencode({
    type = "Scope"
    actions = {
      "Parse_enrichment_response" = {
        type = "ParseJson"
        inputs = {
          content = "@body('HTTP_webhook_enrichment')"
          schema = {
            type = "object"
            properties = {
              risk_score = { type = "number" }
              assets     = { type = "array" }
            }
          }
        }
        runAfter = {}
      }
      "Update_incident_tags" = {
        type = "ApiConnection"
        inputs = {
          host = {
            connection = { name = azurerm_api_connection.sentinel.id }
          }
          method = "patch"
          path   = "/incidents/@{variables('incident_id')}"
          body = {
            # Pass enriched assets from webhook response
            tags = "@{body('Parse_enrichment_response')?['assets']}"
          }
        }
        runAfter = {
          "Parse_enrichment_response" = ["Succeeded"]
        }
      }
    }
    runAfter = {}
  })
 
  depends_on = [azurerm_logic_app_action_http.webhook_call]
}
 
# Catch block - runs only if scope_enrichment fails
resource "azurerm_logic_app_action_custom" "scope_error_handler" {
  name         = "Scope_error_handler"
  logic_app_id = azurerm_logic_app_standard.this.id
 
  body = jsonencode({
    type = "Scope"
    actions = {
      "Log_error_to_law" = {
        type = "ApiConnection"
        inputs = {
          host = {
            connection = { name = azurerm_api_connection.log_analytics.id }
          }
          method = "post"
          # Reference DCE immutable ID from Terraform - not hardcoded
          path = "/api/logs?api-version=2016-04-01&dce=${azurerm_monitor_data_collection_endpoint.this.immutable_id}"
          body = {
            TimeGenerated = "@utcNow()"
            SourceSystem  = "LogicApp"
            Message       = "@{string(outputs('Scope_enrichment'))}"
            IncidentId    = "@{variables('incident_id')}"
            Severity      = "@{variables('severity')}"
          }
        }
        runAfter = {}
      }
      "Alert_team_enrichment_failure" = {
        type = "ApiConnection"
        inputs = {
          host = {
            connection = { name = azurerm_api_connection.teams.id }
          }
          method = "post"
          path   = "/webhooks"
          body = {
            text = "Enrichment failed for incident @{variables('incident_id')} (@{variables('severity')}). Check logs."
          }
        }
        runAfter = {
          "Log_error_to_law" = ["Succeeded"]
        }
      }
    }
    # This scope runs only when the enrichment scope fails or times out.
    runAfter = {
      "Scope_enrichment" = ["Failed", "TimedOut"]
    }
  })
 
  # Error handler runs when scope_enrichment fails (or times out)
  depends_on = [azurerm_logic_app_action_custom.scope_enrichment]
}

# Dependency flow:
# Initialize_variables
#   ├─ HTTP_webhook_enrichment
#   │   ├─ JIRA_create_issue
#   │   └─ Scope_enrichment
#   │       └─ Scope_error_handler (on failure)
#   └─ Condition_severity_check
#       └─ For_each_recipients
 
resource "azurerm_logic_app_action_custom" "initialize_variables" {
  # ... (see above, no depends_on)
}
 
resource "azurerm_logic_app_action_http" "webhook_call" {
  depends_on = [azurerm_logic_app_action_custom.initialize_variables]
  # ...
}
 
resource "azurerm_logic_app_action_custom" "create_jira_ticket" {
  depends_on = [azurerm_logic_app_action_http.webhook_call]
  # ...
}
 
resource "azurerm_logic_app_action_custom" "scope_enrichment" {
  depends_on = [azurerm_logic_app_action_http.webhook_call]
  # ...
}
 
resource "azurerm_logic_app_action_custom" "scope_error_handler" {
  depends_on = [azurerm_logic_app_action_custom.scope_enrichment]
  # Only runs on failure (express in body's runAfter)
}
 
resource "azurerm_logic_app_action_custom" "severity_check" {
  depends_on = [azurerm_logic_app_action_custom.initialize_variables]
  # ...
}
 
resource "azurerm_logic_app_action_custom" "notify_recipients" {
  depends_on = [azurerm_logic_app_action_custom.severity_check]
  # ...
}

# The map key matches the name value in the logic_apps input list.
resource "azurerm_role_assignment" "sentinel_responder" {
  scope                = data.azurerm_resource_group.sentinel.id
  role_definition_name = "Microsoft Sentinel Responder"
  principal_id         = module.logic_apps.logic_app_identities["logic-ldo-uks-prd-01"][0].principal_id
}

resource "azurerm_role_assignment" "sentinel_responder" {
  scope                = data.azurerm_resource_group.sentinel.id
  role_definition_name = "Microsoft Sentinel Responder"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
 
  # principal_id is an attribute of the Logic App, so Terraform infers the dependency.
  # The explicit depends_on is belt-and-braces for the provisioning race condition
  # described in the Key Vault section above.
  depends_on = [azurerm_logic_app_standard.this]
}
 
resource "azurerm_role_assignment" "law_reader" {
  scope                = azurerm_log_analytics_workspace.this.id
  role_definition_name = "Log Analytics Reader"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
  depends_on           = [azurerm_logic_app_standard.this]
}
 
resource "azurerm_role_assignment" "kv_secrets_user" {
  scope                = azurerm_key_vault.this.id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
  depends_on           = [azurerm_logic_app_standard.this]
}

resource "azurerm_storage_account" "logic_app" {
  name                     = "saldouksprd01"   # no hyphens, max 24 chars
  resource_group_name      = azurerm_resource_group.this.name
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "ZRS"              # Zone-redundant for production
  min_tls_version          = "TLS1_2"
  https_traffic_only_enabled = true
  public_network_access_enabled = false         # Use private endpoint or service endpoint
 
  network_rules {
    default_action             = "Deny"
    virtual_network_subnet_ids = [azurerm_subnet.integration.id]
  }
 
  tags = var.tags
}

resource "azurerm_monitor_diagnostic_setting" "logic_app" {
  for_each = module.logic_apps.logic_app_ids
 
  name                       = "diag-${each.key}"
  target_resource_id         = each.value
  log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id
 
  enabled_log { category = "WorkflowRuntime" }
  metric { category = "AllMetrics" }
}

1.  Resource Group
2.  Storage Account          (Standard only - Logic App cannot start without it)
3.  App Service Plan         (Standard only)
4.  User-assigned Identity   (if using shared permission model)
5.  Role Assignments         (on the identity - must exist before App Settings can read KV)
6.  Logic App                (depends on storage, plan, and KV role assignment)
7.  API Connection resources (Sentinel, Teams - depends_on Logic App)
8.  Connection Access Policies (depends_on connection + Logic App identity)
9.  Diagnostic Settings      (depends on Logic App ID)
10. Sentinel Automation Rule (depends on Logic App - references its resource ID)

# ── 1. Storage (Standard Logic App prerequisite) ───────────────────────────
resource "azurerm_storage_account" "logic_app" {
  name                     = "saldouksprd01"
  resource_group_name      = azurerm_resource_group.this.name
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "ZRS"
  min_tls_version          = "TLS1_2"
  https_traffic_only_enabled    = true
  public_network_access_enabled = false
 
  network_rules {
    default_action             = "Deny"
    virtual_network_subnet_ids = [azurerm_subnet.integration.id]
  }
 
  tags = var.tags
}
 
# ── 2. App Service Plan ─────────────────────────────────────────────────────
resource "azurerm_service_plan" "this" {
  name                = "plan-ldo-uks-prd-01"
  resource_group_name = azurerm_resource_group.this.name
  location            = var.location
  os_type             = "Linux"
  sku_name            = "WS1"
  tags                = var.tags
}
 
# ── 3. Key Vault role assignment ────────────────────────────────────────────
# Must be applied BEFORE the Logic App is created.
# The Logic App reads Key Vault references in App Settings on startup.
# If the role does not exist when the Logic App first starts, startup fails.
resource "azurerm_role_assignment" "kv_secrets_user" {
  scope                = azurerm_key_vault.this.id
  role_definition_name = "Key Vault Secrets User"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
 
  # Chicken-and-egg: the principal_id comes from the Logic App, but we need the
  # role before the Logic App can boot. Terraform creates the Logic App first
  # (because principal_id is its attribute), then creates the role.
  # This is acceptable - the Logic App will retry KV reads on first workflow run.
  # If a hard guarantee is needed, use a User-assigned identity whose role
  # assignment can be applied fully before the Logic App is created.
}
 
# ── 4. Logic App ────────────────────────────────────────────────────────────
resource "azurerm_logic_app_standard" "this" {
  name                       = "logic-ldo-uks-prd-01"
  resource_group_name        = azurerm_resource_group.this.name
  location                   = var.location
  app_service_plan_id        = azurerm_service_plan.this.id
  storage_account_name       = azurerm_storage_account.logic_app.name
  storage_account_access_key = azurerm_storage_account.logic_app.primary_access_key
  https_only                 = true
  virtual_network_subnet_id  = azurerm_subnet.integration.id
 
  identity {
    type = "SystemAssigned"
  }
 
  app_settings = {
    "APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.this.instrumentation_key
    "DOWNSTREAM_API_KEY"             = "@Microsoft.KeyVault(VaultName=${azurerm_key_vault.this.name};SecretName=downstream-api-key)"
  }
 
  site_config {
    always_on       = true
    min_tls_version = "1.2"
    ftps_state      = "Disabled"
  }
 
  tags = merge(var.tags, {
    "hidden-title" = "Sentinel Incident - Enrich on High severity"
  })
 
  # Explicit: storage and plan are inferred via attribute refs.
  # Subnet must exist before VNet integration is configured.
  depends_on = [azurerm_subnet.integration]
}
 
# ── 5. Sentinel role assignment ─────────────────────────────────────────────
resource "azurerm_role_assignment" "sentinel_responder" {
  scope                = data.azurerm_resource_group.sentinel.id
  role_definition_name = "Microsoft Sentinel Responder"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
  # Implicit depends_on: principal_id is an attribute of azurerm_logic_app_standard.this
}
 
resource "azurerm_role_assignment" "law_reader" {
  scope                = azurerm_log_analytics_workspace.this.id
  role_definition_name = "Log Analytics Reader"
  principal_id         = azurerm_logic_app_standard.this.identity[0].principal_id
}
 
# ── 6. API connections (azapi) ──────────────────────────────────────────────
resource "azapi_resource" "sentinel_connection" {
  type      = "Microsoft.Web/connections@2016-06-01"
  name      = "conn-sentinel-ldo-uks-prd-01"
  location  = var.location
  parent_id = "/subscriptions/${var.subscription_id}/resourceGroups/${var.rg_name}"
 
  body = {
    properties = {
      displayName        = "Microsoft Sentinel - Managed Identity"
      parameterValueType = "Alternative"
      api = {
        id = "/subscriptions/${var.subscription_id}/providers/Microsoft.Web/locations/${var.location}/managedApis/azuresentinel"
      }
    }
  }
 
  response_export_values = ["*"]
 
  # Connection can be created in parallel with the Logic App - no dependency needed here
}
 
# ── 7. Access policy ────────────────────────────────────────────────────────
# Must wait for: the connection, the Logic App identity, AND the Sentinel role assignment.
# Terraform cannot infer the role assignment dependency - the access policy body
# contains the principal_id as a plain string, not a resource attribute reference.
resource "azapi_resource" "sentinel_connection_access_policy" {
  type      = "Microsoft.Web/connections/accessPolicies@2016-06-01"
  name      = azurerm_logic_app_standard.this.name
  parent_id = azapi_resource.sentinel_connection.id
  location  = var.location
 
  body = {
    properties = {
      principal = {
        type = "ActiveDirectory"
        identity = {
          objectId = azurerm_logic_app_standard.this.identity[0].principal_id
          tenantId = var.tenant_id
        }
      }
    }
  }
 
  depends_on = [
    azapi_resource.sentinel_connection,       # connection must exist first
    azurerm_logic_app_standard.this,          # principal_id must be known
    azurerm_role_assignment.sentinel_responder, # role must be applied - the access policy
                                               # authorises use of the connection; if the
                                               # role doesn't exist yet, the first workflow
                                               # run fails even though the policy exists
  ]
}
 
# ── 8. Diagnostic settings ──────────────────────────────────────────────────
resource "azurerm_monitor_diagnostic_setting" "logic_app" {
  name                       = "diag-logic-ldo-uks-prd-01"
  target_resource_id         = azurerm_logic_app_standard.this.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id
 
  enabled_log { category = "WorkflowRuntime" }
  metric { category = "AllMetrics" }
 
  # Implicit depends_on via target_resource_id
}
 
# ── 9. Sentinel Automation Rule ─────────────────────────────────────────────
resource "azurerm_sentinel_automation_rule" "high_severity_playbook" {
  name                       = "ar-high-severity-enrich-ldo-uks-prd"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id
  display_name               = "High Severity - Run enrichment playbook"
  order                      = 100
  enabled                    = true
 
  condition {
    property  = "IncidentSeverity"
    operator  = "Equals"
    values    = ["High"]
  }
 
  action_playbook {
    logic_app_id            = azurerm_logic_app_standard.this.id
    tenant_id               = var.tenant_id
    order                   = 1
  }
 
  depends_on = [
    azurerm_logic_app_standard.this,             # must exist before rule can reference it
    azapi_resource.sentinel_connection_access_policy, # connection auth must be in place
    azurerm_role_assignment.sentinel_responder,  # Logic App must have Sentinel access
  ]
}

app_settings = {
  "APPINSIGHTS_INSTRUMENTATIONKEY"  = azurerm_application_insights.this.instrumentation_key
  "APPLICATIONINSIGHTS_CONNECTION_STRING" = azurerm_application_insights.this.connection_string
}

AzureDiagnostics
| where ResourceType == "WORKFLOWS"
| where status_s == "Failed"
| where TimeGenerated > ago(24h)
| project TimeGenerated, resource_workflowName_s, status_s, error_code_s, error_message_s
| sort by TimeGenerated desc

resource "azurerm_monitor_metric_alert" "logic_app_failures" {
  for_each = module.logic_apps.logic_app_ids
 
  name                = "alert-${each.key}-failures"
  resource_group_name = var.rg_name
  scopes              = [each.value]
  severity            = 1   # Critical
  frequency           = "PT5M"
  window_size         = "PT15M"
 
  criteria {
    metric_namespace = "Microsoft.Logic/workflows"
    metric_name      = "RunsFailed"
    aggregation      = "Total"
    operator         = "GreaterThan"
    threshold        = 0
  }
 
  action {
    action_group_id = azurerm_monitor_action_group.ops.id
  }
}