Terraform AzAPI Summary Rules

Log Analytics summary rules (Microsoft.OperationalInsights/workspaces/summaryLogs, 2025-07-01 stable) as code, via the Azure/azapi provider, because no native azurerm resource exists for them. A summary rule batch-aggregates a KQL query inside the workspace on a fixed cadence and re-ingests the results into a custom Analytics table: the aggregate-cheap, query-the-aggregate pattern that keeps verbose sources (or whole Basic plan tables) out of your dashboards' hot path.

---

What the module adds over the bare resource

The full 2025-07-01 surface as a typed map (rules keyed by name on one workspace, passed by workspace id per the estate's pass-ids principle), with the service's constraints enforced at plan: bin_size against the API's allowed windows (20, 30, 60, 120, 180, 360, 720, 1440 minutes), destination_table must be a _CL custom table, time_selector locked to the API's single accepted value, the 100-rules-per-workspace cap, and non-negative bin_delay. Unset optionals are dropped from the body, never sent as null. An advisory check warns when a query never aggregates (a one-to-one re-ingest doubles cost; projection-only privacy rules stay legitimate). The API version is a variable, so consumers are never pinned to this module's release cadence.

Operational notes (from the product docs, worth knowing before you deploy)

• Azure Monitor creates the destination table from the query's result schema (and appends columns when it already exists); the results always land on the Analytics plan.
• Rules process the recent past only, up to 24 hours; there is no historical backfill.
• Summary rules themselves are free: you pay the query (data scan on Basic/Auxiliary sources) and the ingestion of the aggregated results.
• Workspace transformations on the destination table are not supported.

Requirements

Name	Version
terraform	>= 1.9.0, < 2.0.0
azapi	>= 2.0.0, < 3.0.0
azurerm	>= 4.0.0, < 5.0.0

Providers

Name	Version
azapi	>= 2.0.0, < 3.0.0

Modules

No modules.

Resources

Name	Type
azapi_resource.summary_rules	resource

Inputs

Name	Description	Type	Default	Required
api_version	API version for Microsoft.OperationalInsights/workspaces/summaryLogs. 2025-07-01 is the first stable version; variablised so consumers are never pinned to this module's release cadence.	string	"2025-07-01"	no
summary_rules	Summary rules keyed by rule name, all created on the parent workspace. Each rule batch-aggregates a KQL query every bin_size minutes and re-ingests the results into destination_table (auto-created by Azure Monitor from the query's schema, always on the Analytics plan; columns are appended when the table already exists). A workspace allows up to 100 active rules, and rules process the recent past only (no historical range beyond 24 hours). - query (required): the aggregation KQL. Analytics-plan sources support all operators bar a small documented set; Basic/Auxiliary sources are single-table with lookup joins only. - bin_size (required): the scheduled window in minutes: 20, 30, 60, 120, 180, 360, 720, or 1440. - destination_table (required): the custom results table, must end _CL. - bin_delay (optional): minimum seconds to wait before processing a bin (ingestion-latency slack). - bin_start_time (optional): UTC time the first execution starts, yyyy-MM-ddTHH:mm format. - time_selector (optional): the bin time cursor; the API currently accepts only TimeGenerated. - display_name / description (optional): portal metadata; display_name defaults to the rule name.	map(object({ query = string bin_size = number destination_table = string bin_delay = optional(number) bin_start_time = optional(string) time_selector = optional(string, "TimeGenerated") display_name = optional(string) description = optional(string) }))	{}	no
workspace_id	Resource id of the parent Log Analytics workspace (the azapi parent), per the pass-ids principle.	string	n/a	yes

Outputs

Name	Description
destination_tables	Map of rule name to its destination custom table name (auto-created by Azure Monitor).
ids	Map of rule name to summary rule resource id.
ids_zipmap	Map of rule name to {name, id} for easy composition.