From b89f9120cb3df082b50d9802c60604fc2ccfb86a Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Tue, 13 Aug 2024 00:55:25 -0400
Subject: [PATCH 01/20] added api connections for workflow

---
 ops/pentest/main.tf                   |   7 ++
 ops/services/alerts/alert_app/_var.tf |  19 ++++
 ops/services/alerts/alert_app/data.tf |  19 ++++
 ops/services/alerts/alert_app/main.tf | 129 ++++++++++++++++++++++++++
 4 files changed, 174 insertions(+)
 create mode 100644 ops/services/alerts/alert_app/_var.tf
 create mode 100644 ops/services/alerts/alert_app/data.tf
 create mode 100644 ops/services/alerts/alert_app/main.tf

diff --git a/ops/pentest/main.tf b/ops/pentest/main.tf
index a078eb8897..d728eef3a7 100644
--- a/ops/pentest/main.tf
+++ b/ops/pentest/main.tf
@@ -102,3 +102,10 @@ module "app_service_autoscale" {
 
   tags = local.management_tags
 }
+
+module "logic_app_workflow" {
+  source = "../services/alerts/alert_app"
+
+  global_vault = data.azurerm_key_vault.global
+
+}
\ No newline at end of file
diff --git a/ops/services/alerts/alert_app/_var.tf b/ops/services/alerts/alert_app/_var.tf
new file mode 100644
index 0000000000..4a49d4560e
--- /dev/null
+++ b/ops/services/alerts/alert_app/_var.tf
@@ -0,0 +1,19 @@
+variable "rg_name" {
+  description = "Name of resource group to deploy into"
+  type        = string
+  default     = "prime-simple-report-pentest"
+}
+
+variable "rg_location" {
+  description = "Location of resource group to deploy into"
+  type        = string
+  default     = "eastus"
+}
+
+variable "global_vault" {
+
+}
+
+variable "channel" {
+  default = "Shanice Musiitwa (ATL, she/her)"
+}
\ No newline at end of file
diff --git a/ops/services/alerts/alert_app/data.tf b/ops/services/alerts/alert_app/data.tf
new file mode 100644
index 0000000000..e81a38153a
--- /dev/null
+++ b/ops/services/alerts/alert_app/data.tf
@@ -0,0 +1,19 @@
+data "azurerm_key_vault_secret" "azure_alert_slack_webhook" {
+  name         = "azure-alert-slack-webhook"
+  key_vault_id = var.global_vault.id
+}
+
+
+data "azurerm_subscription" "primary" {
+
+}
+
+# Resource Groups
+data "azurerm_resource_group" "rg" {
+  # Environments are assembled into shared resource groups by environment level.
+  name = "${local.project}-${local.name}-${local.env_level}"
+}
+
+data "azurerm_resource_group" "rg_global" {
+  name = "${local.project}-${local.name}-management"
+}
\ No newline at end of file
diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
new file mode 100644
index 0000000000..037b291c07
--- /dev/null
+++ b/ops/services/alerts/alert_app/main.tf
@@ -0,0 +1,129 @@
+locals {
+  project   = "prime"
+  name      = "simple-report"
+  env_level = "pentest"
+  management_tags = {
+    prime-app      = "simple-report"
+    resource_group = data.azurerm_resource_group.rg.name
+  }
+}
+
+
+# Define the Logic App Workflow
+resource "azurerm_logic_app_workflow" "slack_workflow" {
+  name     = "alert-logic-app"
+  location = data.azurerm_resource_group.rg.location
+  #Create below api_connection
+  parameters = {
+    connections = azurerm_api_connection.res-6.id
+  }
+  resource_group_name = data.azurerm_resource_group.rg.name
+  workflow_parameters = {
+    connection = "{\"defaultValue\":{},\"type\":\"Object\"}"
+  }
+}
+
+
+# Define the Logic App Workflow Action
+resource "azurerm_logic_app_action_http" "workflow_action" {
+  logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
+  name         = "Http"
+  method       = "POST"
+  #How to get this uri programmtically
+  uri = "https://management.azure.com/subscriptions/${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Logic/workflows/${azurerm_logic_app_action_http.workflow_action.name}/listCallbackUrl?api-version=2016-06-01"
+  body = jsonencode({
+    longUrl = "@{triggerBody()['context']['portalLink']}"
+  })
+  headers = {
+    Content-Type = "application/json"
+  }
+}
+
+
+resource "azurerm_logic_app_action_custom" "res-3" {
+  body = jsonencode({
+    inputs = {
+      host = {
+        connection = {
+          name = azurerm_api_connection.res-6.id
+        }
+      }
+      method = "post"
+      path   = "/chat.postMessage"
+      queries = {
+        channel = var.channel
+        text    = "Azure Alert - '@{triggerBody()['context']['name']}' @{triggerBody()['status']} on '@{triggerBody()['context']['resourceName']}'.  Details: @{body('Http')['id']}"
+      }
+    }
+    runAfter = {
+      Http = ["Succeeded"]
+    }
+    type = "ApiConnection"
+  })
+  logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
+  name         = "Post_Message"
+}
+
+resource "azurerm_logic_app_trigger_http_request" "res-4" {
+  logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
+  name         = "manual"
+  schema = jsonencode({
+    "$schema" = "http://json-schema.org/draft-04/schema#"
+    properties = {
+      context = {
+        properties = {
+          name = {
+            type = "string"
+          }
+          portalLink = {
+            type = "string"
+          }
+          resourceName = {
+            type = "string"
+          }
+        }
+        required = ["name", "portalLink", "resourceName"]
+        type     = "object"
+      }
+      status = {
+        type = "string"
+      }
+    }
+    required = ["status", "context"]
+    type     = "object"
+  })
+
+}
+
+data "azurerm_managed_api" "data_api" {
+  name     = "managed-api-1"
+  location = data.azurerm_resource_group.rg.location
+}
+
+resource "azurerm_api_connection" "api_connection_1" {
+  managed_api_id      = data.azurerm_managed_api.data_api
+  name                = "SlackConnection"
+  resource_group_name = data.azurerm_resource_group.rg.name
+}
+
+resource "azurerm_api_connection" "res-6" {
+  managed_api_id      = data.azurerm_managed_api.data_api
+  name                = "slack-1"
+  resource_group_name = data.azurerm_resource_group.rg.name
+}
+
+
+
+
+#Define the action group, call it as local variable
+resource "azurerm_monitor_action_group" "on_call_action_group" {
+  name                = "OnCallEngineer"
+  resource_group_name = data.azurerm_resource_group.rg.name
+  short_name          = "OnCall"
+  webhook_receiver {
+    name                    = "logicappaction"
+    service_uri             = data.azurerm_key_vault_secret.azure_alert_slack_webhook.value
+    use_common_alert_schema = false
+  }
+}
+

From b224656fc736b7b33a7ecde5000060fa7210007a Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Tue, 13 Aug 2024 13:51:41 -0400
Subject: [PATCH 02/20] modified workflow action body text

---
 ops/services/alerts/alert_app/main.tf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 037b291c07..2c58958ed1 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -30,9 +30,9 @@ resource "azurerm_logic_app_action_http" "workflow_action" {
   name         = "Http"
   method       = "POST"
   #How to get this uri programmtically
-  uri = "https://management.azure.com/subscriptions/${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Logic/workflows/${azurerm_logic_app_action_http.workflow_action.name}/listCallbackUrl?api-version=2016-06-01"
+  uri = data.azurerm_key_vault_secret.azure_alert_slack_webhook.value
   body = jsonencode({
-    longUrl = "@{triggerBody()['context']['portalLink']}"
+    "text" : "Hi from postman"
   })
   headers = {
     Content-Type = "application/json"
@@ -115,7 +115,7 @@ resource "azurerm_api_connection" "res-6" {
 
 
 
-#Define the action group, call it as local variable
+
 resource "azurerm_monitor_action_group" "on_call_action_group" {
   name                = "OnCallEngineer"
   resource_group_name = data.azurerm_resource_group.rg.name

From b0667f8f633e180161f1188b7aa3941bbc1c51c5 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Tue, 13 Aug 2024 15:11:31 -0400
Subject: [PATCH 03/20] added id attribute to managed api reference

---
 ops/services/alerts/alert_app/main.tf | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 2c58958ed1..c586744371 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -95,19 +95,23 @@ resource "azurerm_logic_app_trigger_http_request" "res-4" {
 
 }
 
+
+
 data "azurerm_managed_api" "data_api" {
   name     = "managed-api-1"
   location = data.azurerm_resource_group.rg.location
 }
 
+
+
 resource "azurerm_api_connection" "api_connection_1" {
-  managed_api_id      = data.azurerm_managed_api.data_api
+  managed_api_id      = data.azurerm_managed_api.data_api.id
   name                = "SlackConnection"
   resource_group_name = data.azurerm_resource_group.rg.name
 }
 
 resource "azurerm_api_connection" "res-6" {
-  managed_api_id      = data.azurerm_managed_api.data_api
+  managed_api_id      = data.azurerm_managed_api.data_api.id
   name                = "slack-1"
   resource_group_name = data.azurerm_resource_group.rg.name
 }

From 9eac44e0d1d45508e253ad447158bc13837bdb01 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 10:53:25 -0400
Subject: [PATCH 04/20] added azapi resource to create managed api

---
 ops/services/alerts/alert_app/_var.tf | 20 ++++++++-
 ops/services/alerts/alert_app/main.tf | 59 ++++++++++++++++++++-------
 2 files changed, 63 insertions(+), 16 deletions(-)

diff --git a/ops/services/alerts/alert_app/_var.tf b/ops/services/alerts/alert_app/_var.tf
index 4a49d4560e..730dce7be2 100644
--- a/ops/services/alerts/alert_app/_var.tf
+++ b/ops/services/alerts/alert_app/_var.tf
@@ -15,5 +15,23 @@ variable "global_vault" {
 }
 
 variable "channel" {
-  default = "Shanice Musiitwa (ATL, she/her)"
+  default     = "Shanice Musiitwa (ATL, she/her)"
+  description = "The Slack channel to post to."
+}
+
+variable "slackConnectionName" {
+  type        = string
+  default     = "SlackConnection"
+  description = "The name for the Slack connection."
+}
+
+variable "connection_name" {
+  type        = string
+  description = "This connection must be manually activated in the Azure Console after deployment"
+  default     = "slack"
+}
+
+variable "logicAppName" {
+  default = "Slack-Integration-Workflow"
+
 }
\ No newline at end of file
diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index c586744371..cff80c77eb 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -11,7 +11,7 @@ locals {
 
 # Define the Logic App Workflow
 resource "azurerm_logic_app_workflow" "slack_workflow" {
-  name     = "alert-logic-app"
+  name     = var.logicAppName
   location = data.azurerm_resource_group.rg.location
   #Create below api_connection
   parameters = {
@@ -45,7 +45,7 @@ resource "azurerm_logic_app_action_custom" "res-3" {
     inputs = {
       host = {
         connection = {
-          name = azurerm_api_connection.res-6.id
+          name = azurerm_api_connection.res-6.connection
         }
       }
       method = "post"
@@ -69,49 +69,78 @@ resource "azurerm_logic_app_trigger_http_request" "res-4" {
   name         = "manual"
   schema = jsonencode({
     "$schema" = "http://json-schema.org/draft-04/schema#"
-    properties = {
-      context = {
-        properties = {
-          name = {
+    schemaId = {
+      data = {
+        essentials = {
+          alertId = {
             type = "string"
           }
-          portalLink = {
+          alertRule = {
             type = "string"
           }
-          resourceName = {
+          severity = {
             type = "string"
           }
         }
-        required = ["name", "portalLink", "resourceName"]
+        required = ["alertId", "alertRule", "severity"]
         type     = "object"
       }
       status = {
         type = "string"
       }
     }
-    required = ["status", "context"]
+    required = ["status", "data"]
     type     = "object"
   })
 
 }
 
+resource "azurerm_logic_app_api_connection" "slack" {
+  name                = var.slackConnectionName
+  location            = data.azurerm_resource_group.rg.location
+  resource_group_name = data.azurerm_resource_group.rg.name
 
+  api {
+    id = "/subscriptions/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
+  }
 
-data "azurerm_managed_api" "data_api" {
-  name     = "managed-api-1"
-  location = data.azurerm_resource_group.rg.location
+  display_name = "slack"
+}
+
+
+resource "azapi_resource" "createApiConnectionslack" {
+  type      = "Microsoft.Web/connections@2018-06-07-01"
+  name      = var.connection_name
+  parent_id = data.azurerm_resource_group.rg.id
+  location  = data.azurerm_resource_group.rg.location
+
+
+  body = jsonencode({
+    properties = {
+
+      api = {
+        name        = var.connection_name
+        displayName = "slack"
+        description = "Slack is a team communication tool, that brings together all of your team communications in one place, instantly searchable and available wherever you go."
+        iconUri     = "https://connectoricons-prod.azureedge.net/releases/v1.0.1669/1.0.1669.3522/slack/icon.png"
+        brandColor  = "#78D4B6"
+        id          = "/subscriptions/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
+        type        = "Microsoft.Web/locations/managedApis"
+      }
+    }
+  })
 }
 
 
 
 resource "azurerm_api_connection" "api_connection_1" {
-  managed_api_id      = data.azurerm_managed_api.data_api.id
+  managed_api_id      = azapi_resource.createApiConnectionslack.id
   name                = "SlackConnection"
   resource_group_name = data.azurerm_resource_group.rg.name
 }
 
 resource "azurerm_api_connection" "res-6" {
-  managed_api_id      = data.azurerm_managed_api.data_api.id
+  managed_api_id      = azapi_resource.createApiConnectionslack.id
   name                = "slack-1"
   resource_group_name = data.azurerm_resource_group.rg.name
 }

From 0e1332b867af573df0148905467bc04e62c0d9fb Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 11:03:19 -0400
Subject: [PATCH 05/20] removed additional api connection

---
 ops/services/alerts/alert_app/main.tf | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index cff80c77eb..0e89bde9f5 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -45,7 +45,7 @@ resource "azurerm_logic_app_action_custom" "res-3" {
     inputs = {
       host = {
         connection = {
-          name = azurerm_api_connection.res-6.connection
+          name = azurerm_api_connection.api_connection_1.connection
         }
       }
       method = "post"
@@ -138,12 +138,12 @@ resource "azurerm_api_connection" "api_connection_1" {
   name                = "SlackConnection"
   resource_group_name = data.azurerm_resource_group.rg.name
 }
-
-resource "azurerm_api_connection" "res-6" {
-  managed_api_id      = azapi_resource.createApiConnectionslack.id
-  name                = "slack-1"
-  resource_group_name = data.azurerm_resource_group.rg.name
-}
+#
+# resource "azurerm_api_connection" "res-6" {
+#   managed_api_id      = azapi_resource.createApiConnectionslack.id
+#   name                = "slack-1"
+#   resource_group_name = data.azurerm_resource_group.rg.name
+# }
 
 
 

From a46a7770004f45d00682cdad48b6c72355948c86 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 11:39:53 -0400
Subject: [PATCH 06/20] added a provider to pentest

---
 ops/pentest/_config.tf | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ops/pentest/_config.tf b/ops/pentest/_config.tf
index f938b6f03c..dab9ba7eb5 100644
--- a/ops/pentest/_config.tf
+++ b/ops/pentest/_config.tf
@@ -10,6 +10,10 @@ terraform {
       source  = "hashicorp/azurerm"
       version = "~> 3.100.0"
     }
+    azapi = {
+      source  = "Azure/azapi"
+      version = "1.14.0"
+    }
   }
   required_version = "~> 1.3.3"
 }

From f4eea5863adb81078a888015a16c8feeaa326c2f Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 11:57:51 -0400
Subject: [PATCH 07/20] added provider to alert_app module

---
 ops/services/alerts/alert_app/provider.tf | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 ops/services/alerts/alert_app/provider.tf

diff --git a/ops/services/alerts/alert_app/provider.tf b/ops/services/alerts/alert_app/provider.tf
new file mode 100644
index 0000000000..e69de29bb2

From 3bc3b6c0373be5ffded6f736a41b0208f4ae514b Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 12:02:22 -0400
Subject: [PATCH 08/20] provider.tf file content

---
 ops/services/alerts/alert_app/provider.tf | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/ops/services/alerts/alert_app/provider.tf b/ops/services/alerts/alert_app/provider.tf
index e69de29bb2..d82bda085d 100644
--- a/ops/services/alerts/alert_app/provider.tf
+++ b/ops/services/alerts/alert_app/provider.tf
@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.100.0"
+    }
+    azapi = {
+      source  = "Azure/azapi"
+      version = "1.14.0"
+    }
+  }
+}
\ No newline at end of file

From a36dc6fa6385dcc08491a6a4db98fc1f618de64c Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 12:15:33 -0400
Subject: [PATCH 09/20] fixed connection reference and removed resource
 azurerm_logic_app_api_connection

---
 ops/services/alerts/alert_app/main.tf | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 0e89bde9f5..657bdcb0f0 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -15,7 +15,7 @@ resource "azurerm_logic_app_workflow" "slack_workflow" {
   location = data.azurerm_resource_group.rg.location
   #Create below api_connection
   parameters = {
-    connections = azurerm_api_connection.res-6.id
+    connections = azurerm_api_connection.api_connection_1.id
   }
   resource_group_name = data.azurerm_resource_group.rg.name
   workflow_parameters = {
@@ -95,17 +95,17 @@ resource "azurerm_logic_app_trigger_http_request" "res-4" {
 
 }
 
-resource "azurerm_logic_app_api_connection" "slack" {
-  name                = var.slackConnectionName
-  location            = data.azurerm_resource_group.rg.location
-  resource_group_name = data.azurerm_resource_group.rg.name
-
-  api {
-    id = "/subscriptions/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
-  }
-
-  display_name = "slack"
-}
+# resource "azurerm_logic_app_api_connection" "slack" {
+#   name                = var.slackConnectionName
+#   location            = data.azurerm_resource_group.rg.location
+#   resource_group_name = data.azurerm_resource_group.rg.name
+#
+#   api {
+#     id = "/subscriptions/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
+#   }
+#
+#   display_name = "slack"
+# }
 
 
 resource "azapi_resource" "createApiConnectionslack" {

From 2dea1735ced56c8afcc58ab4ff349e12edea22be Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 12:20:17 -0400
Subject: [PATCH 10/20] modified attribute being called

---
 ops/services/alerts/alert_app/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 657bdcb0f0..4f0ae3a643 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -45,7 +45,7 @@ resource "azurerm_logic_app_action_custom" "res-3" {
     inputs = {
       host = {
         connection = {
-          name = azurerm_api_connection.api_connection_1.connection
+          name = azurerm_api_connection.api_connection_1.name
         }
       }
       method = "post"

From 2c140bd2b2fbfe31154412835bda7fe0ebde0d5b Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 12:38:17 -0400
Subject: [PATCH 11/20] modified resource azapi_resource type

---
 ops/services/alerts/alert_app/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 4f0ae3a643..57accca51e 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -109,7 +109,7 @@ resource "azurerm_logic_app_trigger_http_request" "res-4" {
 
 
 resource "azapi_resource" "createApiConnectionslack" {
-  type      = "Microsoft.Web/connections@2018-06-07-01"
+  type      = "Microsoft.Web/connections@2015-08-01-preview"
   name      = var.connection_name
   parent_id = data.azurerm_resource_group.rg.id
   location  = data.azurerm_resource_group.rg.location

From ac693761e60da154f25fe991deb895a1a1cb84c8 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 12:50:45 -0400
Subject: [PATCH 12/20] turned off schema validation

---
 ops/services/alerts/alert_app/main.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 57accca51e..43e5a16c34 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -113,6 +113,7 @@ resource "azapi_resource" "createApiConnectionslack" {
   name      = var.connection_name
   parent_id = data.azurerm_resource_group.rg.id
   location  = data.azurerm_resource_group.rg.location
+  schema_validation_enabled = false
 
 
   body = jsonencode({

From d71e2a3024bca6c3b6805eae3e3db42305d3f7fd Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 14:07:18 -0400
Subject: [PATCH 13/20] modified reference to subscription

---
 ops/services/alerts/alert_app/main.tf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 43e5a16c34..3e0d53b2f0 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -109,10 +109,10 @@ resource "azurerm_logic_app_trigger_http_request" "res-4" {
 
 
 resource "azapi_resource" "createApiConnectionslack" {
-  type      = "Microsoft.Web/connections@2015-08-01-preview"
-  name      = var.connection_name
-  parent_id = data.azurerm_resource_group.rg.id
-  location  = data.azurerm_resource_group.rg.location
+  type                      = "Microsoft.Web/connections@2015-08-01-preview"
+  name                      = var.connection_name
+  parent_id                 = data.azurerm_resource_group.rg.id
+  location                  = data.azurerm_resource_group.rg.location
   schema_validation_enabled = false
 
 
@@ -125,7 +125,7 @@ resource "azapi_resource" "createApiConnectionslack" {
         description = "Slack is a team communication tool, that brings together all of your team communications in one place, instantly searchable and available wherever you go."
         iconUri     = "https://connectoricons-prod.azureedge.net/releases/v1.0.1669/1.0.1669.3522/slack/icon.png"
         brandColor  = "#78D4B6"
-        id          = "/subscriptions/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
+        id          = "${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
         type        = "Microsoft.Web/locations/managedApis"
       }
     }

From 456d0b1addc648c0052e797c25efcaf80ac40f63 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 14:40:44 -0400
Subject: [PATCH 14/20] modified api connection reference to managed api id

---
 ops/services/alerts/alert_app/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 3e0d53b2f0..4a6f7b396c 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -135,7 +135,7 @@ resource "azapi_resource" "createApiConnectionslack" {
 
 
 resource "azurerm_api_connection" "api_connection_1" {
-  managed_api_id      = azapi_resource.createApiConnectionslack.id
+  managed_api_id      = "${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
   name                = "SlackConnection"
   resource_group_name = data.azurerm_resource_group.rg.name
 }

From 0fde7d98921b27153f3267f4b601253249c98aec Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 16:24:31 -0400
Subject: [PATCH 15/20] added new local variables to identify slack api and
 connection

---
 ops/services/alerts/alert_app/main.tf | 35 +++++++++------------------
 1 file changed, 12 insertions(+), 23 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 4a6f7b396c..6910ba3005 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -6,6 +6,9 @@ locals {
     prime-app      = "simple-report"
     resource_group = data.azurerm_resource_group.rg.name
   }
+  slack_api_id        = "${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/slack"
+  slack_connection_id = "${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/connections/${var.slackConnectionName}"
+
 }
 
 
@@ -13,13 +16,14 @@ locals {
 resource "azurerm_logic_app_workflow" "slack_workflow" {
   name     = var.logicAppName
   location = data.azurerm_resource_group.rg.location
-  #Create below api_connection
   parameters = {
-    connections = azurerm_api_connection.api_connection_1.id
+    connections = local.slack_api_id
   }
   resource_group_name = data.azurerm_resource_group.rg.name
   workflow_parameters = {
-    connection = "{\"defaultValue\":{},\"type\":\"Object\"}"
+    connection = jsonencode({
+      name = local.slack_connection_id
+    })
   }
 }
 
@@ -44,9 +48,9 @@ resource "azurerm_logic_app_action_custom" "res-3" {
   body = jsonencode({
     inputs = {
       host = {
-        connection = {
-          name = azurerm_api_connection.api_connection_1.name
-        }
+        connection = jsonencode({
+          name = local.slack_connection_id
+        })
       }
       method = "post"
       path   = "/chat.postMessage"
@@ -95,17 +99,7 @@ resource "azurerm_logic_app_trigger_http_request" "res-4" {
 
 }
 
-# resource "azurerm_logic_app_api_connection" "slack" {
-#   name                = var.slackConnectionName
-#   location            = data.azurerm_resource_group.rg.location
-#   resource_group_name = data.azurerm_resource_group.rg.name
-#
-#   api {
-#     id = "/subscriptions/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
-#   }
-#
-#   display_name = "slack"
-# }
+
 
 
 resource "azapi_resource" "createApiConnectionslack" {
@@ -139,12 +133,7 @@ resource "azurerm_api_connection" "api_connection_1" {
   name                = "SlackConnection"
   resource_group_name = data.azurerm_resource_group.rg.name
 }
-#
-# resource "azurerm_api_connection" "res-6" {
-#   managed_api_id      = azapi_resource.createApiConnectionslack.id
-#   name                = "slack-1"
-#   resource_group_name = data.azurerm_resource_group.rg.name
-# }
+
 
 
 

From 2e3dc25d1ff94e40552d8067756155335e89432c Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Wed, 14 Aug 2024 18:16:46 -0400
Subject: [PATCH 16/20] added a key to the parameters

---
 ops/services/alerts/alert_app/main.tf | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 6910ba3005..d491535052 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -17,7 +17,9 @@ resource "azurerm_logic_app_workflow" "slack_workflow" {
   name     = var.logicAppName
   location = data.azurerm_resource_group.rg.location
   parameters = {
-    connections = local.slack_api_id
+    connections = jsonencode({
+      name = local.slack_api_id
+    })
   }
   resource_group_name = data.azurerm_resource_group.rg.name
   workflow_parameters = {

From 40ac781926b359830ac1170f7cdf6dcbeddd75f8 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Thu, 15 Aug 2024 00:27:53 -0400
Subject: [PATCH 17/20] modified action body, connection parameter, and removed
 logic app custom action

---
 ops/services/alerts/alert_app/main.tf | 222 ++++++++++++++++++++------
 1 file changed, 169 insertions(+), 53 deletions(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index d491535052..1defb59d29 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -17,15 +17,11 @@ resource "azurerm_logic_app_workflow" "slack_workflow" {
   name     = var.logicAppName
   location = data.azurerm_resource_group.rg.location
   parameters = {
-    connections = jsonencode({
-      name = local.slack_api_id
-    })
+    "$connections" = "{\"slack\":{\"connectionId\":\"/${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/connections/slack\",\"connectionName\":\"slack\",\"id\":\"/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/eastus/managedApis/slack\"}}"
   }
   resource_group_name = data.azurerm_resource_group.rg.name
   workflow_parameters = {
-    connection = jsonencode({
-      name = local.slack_connection_id
-    })
+    "$connections" = "{\"defaultValue\":{},\"type\":\"Object\"}"
   }
 }
 
@@ -38,67 +34,187 @@ resource "azurerm_logic_app_action_http" "workflow_action" {
   #How to get this uri programmtically
   uri = data.azurerm_key_vault_secret.azure_alert_slack_webhook.value
   body = jsonencode({
-    "text" : "Hi from postman"
+    "text" : "@{triggerBody()?['data']?['essentials']?['alertId']}"
   })
   headers = {
     Content-Type = "application/json"
   }
 }
 
-
-resource "azurerm_logic_app_action_custom" "res-3" {
-  body = jsonencode({
-    inputs = {
-      host = {
-        connection = jsonencode({
-          name = local.slack_connection_id
-        })
-      }
-      method = "post"
-      path   = "/chat.postMessage"
-      queries = {
-        channel = var.channel
-        text    = "Azure Alert - '@{triggerBody()['context']['name']}' @{triggerBody()['status']} on '@{triggerBody()['context']['resourceName']}'.  Details: @{body('Http')['id']}"
-      }
-    }
-    runAfter = {
-      Http = ["Succeeded"]
-    }
-    type = "ApiConnection"
-  })
-  logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
-  name         = "Post_Message"
-}
+#
+# resource "azurerm_logic_app_action_custom" "res-3" {
+#   body = jsonencode({
+#     inputs = {
+#       host = {
+#         connection = {
+#           name = "@parameters('$connections')['slack']['connectionId']"
+#         }
+#
+#       }
+#       method = "post"
+#       path   = "/chat.postMessage"
+#       queries = {
+#         channel = var.channel
+#         text    = "Azure Alert - '@{triggerBody()['context']['name']}' @{triggerBody()['status']} on '@{triggerBody()['context']['resourceName']}'.  Details: @{body('Http')['id']}"
+#       }
+#     }
+#     runAfter = {
+#       Http = ["Succeeded"]
+#     }
+#     type = "ApiConnection"
+#   })
+#   logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
+#   name         = "Post_Message"
+# }
 
 resource "azurerm_logic_app_trigger_http_request" "res-4" {
   logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
-  name         = "manual"
-  schema = jsonencode({
-    "$schema" = "http://json-schema.org/draft-04/schema#"
-    schemaId = {
-      data = {
-        essentials = {
-          alertId = {
-            type = "string"
-          }
-          alertRule = {
-            type = "string"
-          }
-          severity = {
-            type = "string"
+  name         = "When a HTTP request is received"
+  schema       = <<SCHEMA
+{
+  "type": "Request",
+  "kind": "Http",
+  "inputs": {
+    "schema": {
+      "type": "object",
+      "properties": {
+        "schemaId": {
+          "type": "string"
+        },
+        "data": {
+          "type": "object",
+          "properties": {
+            "essentials": {
+              "type": "object",
+              "properties": {
+                "alertId": {
+                  "type": "string"
+                },
+                "alertRule": {
+                  "type": "string"
+                },
+                "severity": {
+                  "type": "string"
+                },
+                "signalType": {
+                  "type": "string"
+                },
+                "monitorCondition": {
+                  "type": "string"
+                },
+                "monitoringService": {
+                  "type": "string"
+                },
+                "alertTargetIDs": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "configurationItems": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "originAlertId": {
+                  "type": "string"
+                },
+                "firedDateTime": {
+                  "type": "string"
+                },
+                "resolvedDateTime": {
+                  "type": "string"
+                },
+                "description": {
+                  "type": "string"
+                },
+                "essentialsVersion": {
+                  "type": "string"
+                },
+                "alertContextVersion": {
+                  "type": "string"
+                }
+              }
+            },
+            "alertContext": {
+              "type": "object",
+              "properties": {
+                "properties": {},
+                "conditionType": {
+                  "type": "string"
+                },
+                "condition": {
+                  "type": "object",
+                  "properties": {
+                    "windowSize": {
+                      "type": "string"
+                    },
+                    "allOf": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "metricName": {
+                            "type": "string"
+                          },
+                          "metricNamespace": {
+                            "type": "string"
+                          },
+                          "operator": {
+                            "type": "string"
+                          },
+                          "threshold": {
+                            "type": "string"
+                          },
+                          "timeAggregation": {
+                            "type": "string"
+                          },
+                          "dimensions": {
+                            "type": "array",
+                            "items": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string"
+                                },
+                                "value": {
+                                  "type": "string"
+                                }
+                              },
+                              "required": [
+                                "name",
+                                "value"
+                              ]
+                            }
+                          },
+                          "metricValue": {
+                            "type": "number"
+                          }
+                        },
+                        "required": [
+                          "metricName",
+                          "metricNamespace",
+                          "operator",
+                          "threshold",
+                          "timeAggregation",
+                          "dimensions",
+                          "metricValue"
+                        ]
+                      }
+                    }
+                  }
+                }
+              }
+            }
           }
         }
-        required = ["alertId", "alertRule", "severity"]
-        type     = "object"
-      }
-      status = {
-        type = "string"
       }
     }
-    required = ["status", "data"]
-    type     = "object"
-  })
+  }
+}
 
+SCHEMA
 }
 
 

From 2c58a03d1e758621b93f56883096a6ec39fe1737 Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Thu, 15 Aug 2024 00:53:05 -0400
Subject: [PATCH 18/20] fixed parameter named connections

---
 ops/services/alerts/alert_app/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 1defb59d29..60c4670822 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -17,7 +17,7 @@ resource "azurerm_logic_app_workflow" "slack_workflow" {
   name     = var.logicAppName
   location = data.azurerm_resource_group.rg.location
   parameters = {
-    "$connections" = "{\"slack\":{\"connectionId\":\"/${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/connections/slack\",\"connectionName\":\"slack\",\"id\":\"/${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/eastus/managedApis/slack\"}}"
+    "$connections" = "{\"slack\":{\"connectionId\":\"${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/connections/slack\",\"connectionName\":\"slack\",\"id\":\"${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/eastus/managedApis/slack\"}}"
   }
   resource_group_name = data.azurerm_resource_group.rg.name
   workflow_parameters = {

From 48cd6e5eef5b73931ee19e8c122aeb85b1341b9f Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Thu, 15 Aug 2024 01:45:02 -0400
Subject: [PATCH 19/20] removed comments and resources no longer used, added
 logic app receiver

---
 ops/services/alerts/alert_app/_var.tf |  7 +---
 ops/services/alerts/alert_app/main.tf | 47 +++------------------------
 2 files changed, 6 insertions(+), 48 deletions(-)

diff --git a/ops/services/alerts/alert_app/_var.tf b/ops/services/alerts/alert_app/_var.tf
index 730dce7be2..3b7904ec0b 100644
--- a/ops/services/alerts/alert_app/_var.tf
+++ b/ops/services/alerts/alert_app/_var.tf
@@ -19,15 +19,10 @@ variable "channel" {
   description = "The Slack channel to post to."
 }
 
-variable "slackConnectionName" {
-  type        = string
-  default     = "SlackConnection"
-  description = "The name for the Slack connection."
-}
 
 variable "connection_name" {
   type        = string
-  description = "This connection must be manually activated in the Azure Console after deployment"
+  description = "This connection must be manually activated in the Azure Console after deployment to test other will have to wait for Alert Group to trigger it"
   default     = "slack"
 }
 
diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 60c4670822..3a4d165728 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -6,9 +6,6 @@ locals {
     prime-app      = "simple-report"
     resource_group = data.azurerm_resource_group.rg.name
   }
-  slack_api_id        = "${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/slack"
-  slack_connection_id = "${data.azurerm_subscription.primary.id}/resourceGroups/${data.azurerm_resource_group.rg.name}/providers/Microsoft.Web/connections/${var.slackConnectionName}"
-
 }
 
 
@@ -41,31 +38,7 @@ resource "azurerm_logic_app_action_http" "workflow_action" {
   }
 }
 
-#
-# resource "azurerm_logic_app_action_custom" "res-3" {
-#   body = jsonencode({
-#     inputs = {
-#       host = {
-#         connection = {
-#           name = "@parameters('$connections')['slack']['connectionId']"
-#         }
-#
-#       }
-#       method = "post"
-#       path   = "/chat.postMessage"
-#       queries = {
-#         channel = var.channel
-#         text    = "Azure Alert - '@{triggerBody()['context']['name']}' @{triggerBody()['status']} on '@{triggerBody()['context']['resourceName']}'.  Details: @{body('Http')['id']}"
-#       }
-#     }
-#     runAfter = {
-#       Http = ["Succeeded"]
-#     }
-#     type = "ApiConnection"
-#   })
-#   logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
-#   name         = "Post_Message"
-# }
+
 
 resource "azurerm_logic_app_trigger_http_request" "res-4" {
   logic_app_id = azurerm_logic_app_workflow.slack_workflow.id
@@ -246,25 +219,15 @@ resource "azapi_resource" "createApiConnectionslack" {
 
 
 
-resource "azurerm_api_connection" "api_connection_1" {
-  managed_api_id      = "${data.azurerm_subscription.primary.id}/providers/Microsoft.Web/locations/${data.azurerm_resource_group.rg_global.location}/managedApis/${var.connection_name}"
-  name                = "SlackConnection"
-  resource_group_name = data.azurerm_resource_group.rg.name
-}
-
-
-
-
-
 
 resource "azurerm_monitor_action_group" "on_call_action_group" {
   name                = "OnCallEngineer"
   resource_group_name = data.azurerm_resource_group.rg.name
   short_name          = "OnCall"
-  webhook_receiver {
-    name                    = "logicappaction"
-    service_uri             = data.azurerm_key_vault_secret.azure_alert_slack_webhook.value
+  logic_app_receiver {
+    name                    = var.logicAppName
+    resource_id             = azurerm_logic_app_workflow.slack_workflow.id
+    callback_url            = azurerm_logic_app_workflow.slack_workflow.access_endpoint
     use_common_alert_schema = false
   }
 }
-

From 884502619e7a81bd73d94df28fc7668283a748aa Mon Sep 17 00:00:00 2001
From: shanice-skylight <shanice@skylight.digital>
Date: Thu, 15 Aug 2024 20:46:59 -0400
Subject: [PATCH 20/20] modified the body of the alert and updated the channel
 alerts are sent to

---
 ops/services/alerts/alert_app/_var.tf | 4 ++--
 ops/services/alerts/alert_app/main.tf | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ops/services/alerts/alert_app/_var.tf b/ops/services/alerts/alert_app/_var.tf
index 3b7904ec0b..c77d18c21e 100644
--- a/ops/services/alerts/alert_app/_var.tf
+++ b/ops/services/alerts/alert_app/_var.tf
@@ -15,8 +15,8 @@ variable "global_vault" {
 }
 
 variable "channel" {
-  default     = "Shanice Musiitwa (ATL, she/her)"
-  description = "The Slack channel to post to."
+  default     = "project-sr-on-call-alerts"
+  description = "The Slack channel that the alerts are sent to."
 }
 
 
diff --git a/ops/services/alerts/alert_app/main.tf b/ops/services/alerts/alert_app/main.tf
index 3a4d165728..c63c9b59ca 100644
--- a/ops/services/alerts/alert_app/main.tf
+++ b/ops/services/alerts/alert_app/main.tf
@@ -31,7 +31,7 @@ resource "azurerm_logic_app_action_http" "workflow_action" {
   #How to get this uri programmtically
   uri = data.azurerm_key_vault_secret.azure_alert_slack_webhook.value
   body = jsonencode({
-    "text" : "@{triggerBody()?['data']?['essentials']?['alertId']}"
+    "text" : "@{triggerBody()?['data']?['essentials']}"
   })
   headers = {
     Content-Type = "application/json"