feat(azure_metrics): add resource_manager_audience for sovereign cloud (GovCloud) support#20266
feat(azure_metrics): add resource_manager_audience for sovereign cloud (GovCloud) support#20266zmoog wants to merge 3 commits into
Conversation
…d support Add the missing `resource_manager_audience` configuration option to all azure_metrics data streams (monitor, compute_vm, compute_vm_scaleset, container_instance, container_registry, container_service, database_account, storage_account). Without this field, users targeting sovereign clouds (e.g. GovCloud) cannot override the OAuth2 token audience. Even with resource_manager_endpoint and active_directory_endpoint correctly set to GovCloud values, ARM rejects the request with SubscriptionNotFound because the token is scoped for the public cloud audience (management.core.windows.net). The fix mirrors azure_billing, which already exposes all three settings. Fixes: elastic/sdh-beats#7390 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
For support, reach out in the #docs Slack channel. cc @elastic/integration-docs |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add resource_manager_audience to the _dev/build/docs/README.md template and regenerate docs/README.md with elastic-package build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This comment has been minimized.
This comment has been minimized.
TL;DRThe Remediation
Investigation detailsRoot CauseAt the failed SHA, the README template at Evidence
VerificationNo local package test was run because the workspace is on What is this? | From workflow: PR Buildkite Detective Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. |
|
✅ All changelog entries have the correct PR link. |
💚 Build Succeeded
History
|
Summary
resource_manager_audienceconfiguration field to all eightazure_metricsdata streams (monitor,compute_vm,compute_vm_scaleset,container_instance,container_registry,container_service,database_account,storage_account)docs/README.mdwith field description and sovereign-cloud audience values1.15.0Problem
Azure sovereign clouds (e.g. GovCloud) require three settings to be redirected correctly:
resource_manager_endpointhttps://management.usgovcloudapi.net/active_directory_endpointhttps://login.microsoftonline.usresource_manager_audiencehttps://management.core.usgovcloudapi.netazure_metricsexposed only the first two. Withoutresource_manager_audience, the Beats Azure Monitor client requests an OAuth2 token scoped for the public cloud audience (https://management.core.windows.net/) even when the other endpoints are set to GovCloud values. ARM then rejects the token with:azure_billingalready exposes all three settings correctly. This PR bringsazure_metricsto parity.Test plan
azure_metricsintegration with GovCloud endpoints andresource_manager_audience: https://management.core.usgovcloudapi.net— verify metrics are collected withoutSubscriptionNotFounderrorsresource_manager_audienceset — verify existing public-cloud behaviour is unchangedshow_user: false) in the Kibana integration UI advanced settings🤖 Generated with Claude Code