Error trying to implement cost management exports for billing account scope

[jrgrazina]

Description

I'd like to be able to create a cost management export with the scope being the billing account. We use enterprise enrolment for Azure and this would be super useful for us.

I've attempted to use the azapi. Whilst it works (creates the Exports at a Billing Account Scope) it won't complete in TF and then write to the state:
this

c6713524e98/providers/Microsoft.CostManagementExports]
module.azure_interno.azapi_resource.cm_export: Creating...
module.azure_interno.azapi_resource.cm_export: Still creating... [10s elapsed]
module.azure_interno.azapi_resource.cm_export: Still creating... [20s elapsed]
module.azure_interno.azapi_resource.cm_export: Still creating... [30s elapsed]
module.azure_interno.azapi_resource.cm_export: Still creating... [40s elapsed]
module.azure_interno.azapi_resource.cm_export: Still creating... [50s elapsed]
module.azure_interno.azapi_resource.cm_export: Still creating... [1m0s elapsed]
╷
│ Error: creating/updating "Resource: (ResourceId "/providers/Microsoft.Billing/billingAccounts/<BILLING_ACCT_#>/providers/Microsoft.CostManagement/exports/finopsreportnosmonthly" / Api Version "2021-10-01")": Get "https://costmanagement.trafficmanager.net/providers/Microsoft.Billing/billingAccounts/<BILLING_ACCT_#>/providers/Microsoft.CostManagement/exports/finopsreportmonthly?api-version=2021-10-01": local error: tls: no renegotiation
│
│ with module.azure_interno.azapi_resource.cm_export,
│ on model_integration/main.tf line 81, in resource "azapi_resource" "cm_export":
│ 81: resource "azapi_resource" "cm_export" {
│
╵

and that is the model used on azapi provider

  # module.azure_interno.azapi_resource.cm_export will be created
  + resource "azapi_resource" "cm_export" {
      + body                      = (known after apply)
      + id                        = (known after apply)
      + ignore_casing             = true
      + ignore_missing_property   = true
      + location                  = (known after apply)
      + name                      = "finopsreportmonthly"
      + output                    = (known after apply)
      + parent_id                 = "/providers/Microsoft.Billing/billingAccounts/<BILLING_ACCT_#>"
      + response_export_values    = [
          + "*",
        ]
      + schema_validation_enabled = false
      + tags                      = (known after apply)
      + type                      = "Microsoft.CostManagement/exports@2021-10-01"

      + identity {
          + identity_ids = (known after apply)
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = (known after apply)
        }
    }

[ms-henglu]

Hi @jrgrazina ,

Thank you for taking time to open this issue!

It seems to be an intermittent error on the server-side, would you please try to create it again? Or you can import this resource to the terraform state, by

terraform import azapi_resource.cm_export /providers/Microsoft.Billing/billingAccounts/<BILLING_ACCT_#>/providers/Microsoft.CostManagement/exports/finopsreportnosmonthly

I've created an issue to track this: Azure/azure-rest-api-specs#20726

[jrgrazina]

Hey @ms-henglu ,

I tried to import and it gave me this error:

this one

terraform import azapi_resource.cm_export /providers/Microsoft.Billing/billingAccounts/<BILLING_ACCT_#>/providers/Microsoft.CostManagement/exports/finopsreportnosmonthly
Error: resource address "azapi_resource.cm_export" does not exist in the configuration.

Before importing this resource, please create its configuration in the root module. For example:

resource "azapi_resource" "cm_export" {
  # (resource arguments)
}

And other thing, i tried open this link (the get call) "https://costmanagement.trafficmanager.net/providers/Microsoft.Billing/billingAccounts/<BILLING_ACCT#>/providers/Microsoft.CostManagement/exports/finopsreportmonthly?api-version=2021-10-01"_

and they asked for a certificate when i tried open in the browser

[ms-henglu]

Hi @jrgrazina ,

When import existing resources into terraform, the config should be created in tf files first and its arguments can be omitted temporarily, for example

resource "azapi_resource" "cm_export" {
}

And another thing, i tried open this link (the get call)
Yes, I think a credential needs to be provided. For example, you can get an access token by azure cli command: az account get-access-token, then add it to Header: Authorization: Bearer {accessToken}.

[jrgrazina]

Hi @ms-henglu

my mistake, I made it wrong the import command

And yes I can import the resource, but I can't create it ( it's created in azure but always gives me this no tls renegotiation error in TF )

[ms-henglu]

Update: It's an issue on the client-side, the root cause is: Azure/azure-sdk-for-go#19469

[tpidor]

Hello,
The new billing_account_cost_management_export module resource (from hashicorp/terraform-provider-azurerm#14726) is working well in our automation to generate Cost Export at the billing scope.
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/billing_account_cost_management_export

We also have a requirement to do a one-time export of historical Actual and Amortized Costs of Nov'22, Dec'22 and Jan'23. But since today is 6/Feb/23 so Cost Export UI in portal can only start from 6/Nov/22 instead of 1/Nov/22 which is due to a 90-day limit as per https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/tutorial-export-acm-data?tabs=azure-portal

I'm looking at this billing_account_cost_management_export resource to do a one-time export and tried
recurrence_type = "Monthly"
recurrence_period_start_date = "2022-11-01T00:00:00Z"
recurrence_period_end_date = timeadd("2022-11-01T00:00:00Z","720h") #30 Days for adhoc one-time export
active = false
time_frame = "Custom"

but Terraform apply is failing with a time period that is in the past -
exports.ExportsClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="400" Message="Request properties validation failed: Missing definition timePeriod; specify a period in the past.\r\n (Request ID: 6e3498fd-e178-4194-b9f1-87da2fdfa663)"

The key question is - can the billing_account_cost_management_export Terraform module resource support one-time export? If yes, please advise the appropriate parameter values. If not, any idea how can this be done only if possible since UI has a 90-day limit? Thanks in advance.

[DennisKreibichGKGAB]

Any updates here?
Experiencing the issue too:

│ Error: creating/updating "Resource: (ResourceId \"/subscriptions/my-sub-id/providers/Microsoft.CostManagement/ScheduledActions/costanomalyalert\" / Api Version \"2022-06-01-preview\")": Get "https://scheduledactions.costmgmt.azure.com/subscriptions/my-sub-id/providers/Microsoft.CostManagement/ScheduledActions/costanomalyalert?api-version=2022-06-01-preview": local error: tls: no renegotiation

Code looks like:

resource "azapi_resource" "costanomalyalert" {  
  type = "Microsoft.CostManagement/ScheduledActions@2022-06-01-preview"
  name = "costanomalyalert"
  parent_id = var.subscription_id
  body = jsonencode({
    properties = {
      displayName = "Daily anomaly by resource group"
      fileDestination = {
        fileFormats = ["Csv"]
      }
      notification = {
        message = format("%s - Cost anomaly alert for %s",var.cost_anomaly_config.alert_message_key , data.azurerm_subscription.costanomalyalert.display_name)
        subject = format("Cost anomaly alert for Sub %s", data.azurerm_subscription.costanomalyalert.subscription_id)
        to = var.cost_anomaly_config.recipient_mails
      }
      schedule = {
        frequency = var.cost_anomaly_config.schedule.frequency
        startDate = var.cost_anomaly_config.schedule.startDate
        endDate = var.cost_anomaly_config.schedule.endDate
        hourOfDay = var.cost_anomaly_config.schedule.hourOfDay
        dayOfMonth = var.cost_anomaly_config.schedule.dayOfMonth
        daysOfWeek = var.cost_anomaly_config.schedule.daysOfWeek
        weeksOfMonth = var.cost_anomaly_config.schedule.weeksOfMonth
      }
      scope = var.subscription_id
      status = "Enabled"
      viewId = format("%s/providers/Microsoft.CostManagement/views/ms:DailyAnomalyByResourceGroup", var.subscription_id)
    }
    kind = "InsightAlert"
  })
}

[YoshicoppensE61]

Similar issue here, but with the CostManagement Exports iso Billing.

Error: creating/updating "Resource: (ResourceId \"/subscriptions/3f63cada-afba-459b-88d7-c441a2fbbc59/providers/Microsoft.CostManagement/exports/OneTimeExport3\" / Api Version \"2022-10-01\")": Get "https://costmanagement.trafficmanager.net/subscriptions/3f63cada-afba-459b-88d7-c441a2fbbc59/providers/Microsoft.CostManagement/exports/OneTimeExport3?api-version=2022-10-01": local error: tls: no renegotiation

Code looks like

resource "azapi_resource" "export" {
  type = "Microsoft.CostManagement/exports@2022-10-01"
  name =  "xxxxxx"
  parent_id = "/subscriptions/${var.subscription_id}"
  body = jsonencode({
    properties = {
      definition = {
        dataSet = {
          granularity = "Daily"
        }
        timeframe = "Custom"
        timePeriod = {
             from = var.export_start_date
             to = var.export_end_date
       }
        type = "ActualCosts"
      }
      deliveryInfo = {
        destination = {
          container = xxxxxx
          resourceId = xxxxxxxx
          rootFolderPath =xxxxx
        }
      }
      format = "Csv"
      partitionData = false
    }
  })
}

Sidenote, I cannot use the azurerm terraform provider because that one does not allow for a OneTimeExport yet (there is no timeperiod_from, timeperiod_to data). But even if I do a non-OneTimeExport using azapi, I get the same error. So seems like a clear bug in the azapi resource?

[YoshicoppensE61]

The above ticket completion of azcore should unblock this issue. Can an upgrade be made in an upcoming terraform provider release to update azcore to v1.7.1?

[ms-henglu]

Hi all,

Apologize for late update.

I've confirmed with ARM team that this is an API bug, that all control plane APIs should flow through ARM, which means client doesn't need to access "https://costmanagement.trafficmanager.net". I've created an issue to track it: Azure/azure-rest-api-specs#25356

Meanwhile, I raised a bug fix in the azapi provider that these errors from the nonstandard polling APIs will be ignored. And this bug fix will be released in v1.9.0.

bugfix: #341

[ms-henglu]

I'll close this issue since the bugfix is released in v1.9.0, please feel free to reopen it, thanks!