Bicep Modul for an Anommaly Alert

In our CAF Landing Zone Starter Kit, the implementation of the Anomaly Alert on the subscription was missing until now. This is almost finished. First of all, here is a possible implementation of the Anomaly Alert as a bicep module.

Anomaly Alert Bicep

targetScope = 'subscription'

@description('Name of the Anomaly Alert')
param aaName string = 'myAnomalyAlert'

@description('Display Name of the Anomaly Alert')
param aaDisplayName string = 'Anomaly Alert'

@description('Subject of the Anomaly Alert email notification')
param aaNotificationSubject string = 'Anomaly Alert detected for your Subscription'

@description('Email address to send the Anomaly Alert notification to')
param aaNotificationTo string 

@description('Message of the Anomaly Alert email notification')
param aaNotificationMessage string = 'The Anomaly Alert has been triggered for your Subscription ${subscription().subscriptionId}. Please check the Cost Management Dashboard for more details.'

@description('Start date of the Anomaly Alert (default: now)')
param aaStartDate string = utcNow('u')

@description('End date of the Anomaly Alert (default: 1 year from now)')
param aaEndDate string = dateTimeAdd(utcNow('u'), 'P1Y')

// The kind of the Anomaly Alert must be 'InsightAlert'
var aaKind = 'InsightAlert'

resource myAnomalyAlert 'Microsoft.CostManagement/scheduledActions@2022-10-01' = {
  name: aaName
  kind: aaKind
  properties: {
    displayName: aaDisplayName
    scope: '/subscriptions/${subscription().subscriptionId}'
    notification: {
      subject: aaNotificationSubject
      to: [
        aaNotificationTo
      ]
      message: aaNotificationMessage
    }
    status: 'Enabled'
    viewId:  resourceId('Microsoft.CostManagement/views/','ms:DailyAnomalyByResourceGroup')
    schedule: {
      endDate: aaEndDate
      frequency: 'Daily'
      startDate: aaStartDate
    }
  }
}

Deployment of the modul

The module can be applied via the Azure CLI. The only important thing is to check beforehand that you are in the right subscription. Then the application is quite simple:

az deployment sub create --name aaDeplyoment01 --location westeurope --template-file .\main.bicep

The deployment then queries the e-mail address and sets the anomaly alert.

Links

Microsoft Learn - Anomaly Alert

Microsoft.CostManagement/scheduledActions API