Logic app finops-alerts :: No resources are idle.

[francesco1119]

🐛 Problem

I deployed the finops-alerts Logic app.
The e-mail is fired but I receive it empty:

Idle Application Gateway Details
No resources are idle.
Idle Disk Details
No resources are idle.
Idle IP Address Details
No resources are idle.
Idle Load Balancer Details
No resources are idle.
Old Disk Snapshot Details
No resources are idle.
Stopped VM Details
No resources are idle.

🤔 Expected

It should contain idle resources

[francesco1119]

I think I start to have a grip on this too.

In the variable Included subscriptions I should enumerate all Subscriptions like this?

[
  "4db13f59-bb74-468c-b0fc-8a1866a7fc50",
  "2f649a06-cb26-44ef-b7cc-5f53f2eef2b4"
]

Isn't there a way to put all Subscriptions by default?

[helderpinto]

@francesco1119, did you grant the Reader role to the Logic App managed identity across all subscriptions (ideally at a management group level)? If so, you don't have to define the Included subscriptions variable. The Logic App will default to all subscriptions the identity has access to.

Also, how sure are you there are idle resources? Have you tried to run the Logic App ARG queries in your environment and confirm there actually are idle resources? In each ARG query, just replace the resourcesTable variable with the resources string.

[francesco1119]

The query:

resources
| where type =~ 'microsoft.compute/virtualmachines' and tostring(properties.extended.instanceView.powerState.displayStatus) != 'VM deallocated' and tostring(properties.extended.instanceView.powerState.displayStatus) != 'VM running'| extend  VMname=name, PowerState=tostring(properties.extended.instanceView.powerState.displayStatus), VMLocation=location, VirtualMachineId=id| order by VirtualMachineId asc| project VirtualMachineId,VMname, PowerState, VMLocation, resourceGroup, subscriptionId |  join kind=leftouter ( resourcecontainers | where type == 'microsoft.resources/subscriptions' | project subscriptionId, subscriptionName = name) on subscriptionId

is returning nothing:

But the VMs are there:

[helderpinto]

@francesco1119, that query is looking for VMs that are Stopped. Your VMs are Stopped (deallocated). Stopped (not deallocated) VMs are considered idle resources because they are still incurring in Compute costs despite having been stopped. This usually happens when they are shut down from within the operating system (not from the Azure platform). In summary, the query is returning empty results as expected.

[francesco1119]

OK, fair enough.

I cannot believe I'm doing my job so well.

Now, Get idle Disks, this is the query I find in the ADF:

resources
| where type =~ 'microsoft.compute/disks'
  and managedBy == ''
| extend diskState = tostring(properties.diskState)
| where
    (managedBy == '' and diskState != 'ActiveSAS')
    or (diskState == 'Unattached' and diskState != 'ActiveSAS')
| extend
    DiskId       = id,
    DiskName     = name,
    SKUName      = sku.name,
    SKUTier      = sku.tier,
    DiskSizeGB   = tostring(properties.diskSizeGB),
    Location     = location,
    TimeCreated  = tostring(properties.timeCreated)
| order by DiskId asc
| project
    DiskId,
    DiskName,
    DiskSizeGB,
    SKUName,
    SKUTier,
    resourceGroup,
    Location,
    TimeCreated,
    subscriptionId
| join kind=leftouter (
    resourcecontainers
    | where type == 'microsoft.resources/subscriptions'
    | project
        subscriptionId,
        subscriptionName = name
) on subscriptionId

It returns 38 idle disks:

But still this morning no idle disks in the e-mail

[helderpinto]

@francesco1119, the identity (yourself) running the query that returned 38 idle disks is not the same as the identity that is running the query from the Logic App.

Please, open the Identity blade in the Logic App as below and verify its role assignments

For each subscription the 38 idle disks belong to, please confirm the Logic App identity owns at least the Reader role

Also, check the "Get idle Disks" step in the Logic App is using the system-assigned managed identity to authenticate against Resource Graph and is using the "tenant" scope

[francesco1119]

Look, I see where the problem is: Resource Type is Management Group:

Is should be Subscription, right?

[helderpinto]

@francesco1119, that should not be a problem. The role assignment was given at a higher scope, which is better, because it covers multiple subscriptions at once. The problem must be elsewhere. Have you checked the run history and confirmed the outputs for that query step also return empty?