Add tier-aware APIM metric alert defaults - #2130
Open
christian-calabrese wants to merge 10 commits into
Open
Conversation
Use Azure-supported metrics by APIM tier while preserving explicit alert overrides and optional Action Group routing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep development overrides disabled and limit failed request alerts to 5xx responses so they do not overlap unauthorized traffic. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
christian-calabrese
marked this pull request as draft
September 2, 2026 09:55
gunzip
reviewed
Sep 2, 2026
| dimension = [{ | ||
| name = "GatewayResponseCode" | ||
| operator = "Include" | ||
| values = ["401", "403", "429"] |
Contributor
There was a problem hiding this comment.
thoughts: 429 is not unauthorized
Treat 429 as throttling rather than unauthorized, keep only 401 and 403 in the default unauthorized alert, and document why no separate 429 alert is added. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep the ticket thresholds as explicit workload baselines while selecting them from separate use-case maps and preserving SKU-specific metric support. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use two-unit Premium operational traffic thresholds while retaining workload-specific duration and resource baselines. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Document tier mappings, supported metrics, thresholds, overrides, and development alert gating without conversational rationale. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
christian-calabrese
marked this pull request as ready for review
September 3, 2026 12:56
krusty93
reviewed
Sep 4, 2026
| description = <<EOD | ||
| Map of name = criteria objects | ||
| EOD | ||
| description = "Optional map of metric alert definitions. When null, the module creates supported defaults for the selected use_case; pass an explicit empty map to disable alerts or a custom map to override the defaults." |
Contributor
There was a problem hiding this comment.
Suggested change
| description = "Optional map of metric alert definitions. When null, the module creates supported defaults for the selected use_case; pass an explicit empty map to disable alerts or a custom map to override the defaults." | |
| description = "Optional map of metric alert definitions. When null, the module creates supported defaults for the selected use_case." |
krusty93
reviewed
Sep 4, 2026
|
|
||
| | Use case | SKU | Requests total/success/5xx/unauthorized | Duration | Capacity | Gateway CPU/memory | | ||
| |----------|-----|------------------------------------------|----------|----------|--------------------| | ||
| | `development` | `Developer_1` | 10000/9500/100/50 (unused) | 500 ms (unused) | 80% (unused) | 80%/80% (unused) | |
Contributor
There was a problem hiding this comment.
question: Why does development has thresholds if they're not used?
krusty93
reviewed
Sep 4, 2026
| For `cost_optimized` (`StandardV2_1`), the module creates five-minute alerts | ||
| for `Requests` (total, successful, failed, and unauthorized requests), | ||
| `Duration`, `CpuPercent_Gateway`, and `MemoryPercent_Gateway`. The thresholds | ||
| are 10000, 9500, 100, and 50 for the request alerts, 500 ms for `Duration`, |
Contributor
There was a problem hiding this comment.
thought: hardcoded values might be misleading and dangerous, is there any way to replace them with percentages?
krusty93
reviewed
Sep 4, 2026
|
|
||
| ### Default metric alerts | ||
|
|
||
| For `cost_optimized` (`StandardV2_1`), the module creates five-minute alerts |
Contributor
There was a problem hiding this comment.
issue: I don't see the point in having the same documentation in table and free text
Remove unused development thresholds and consolidate the default alert documentation while clarifying absolute five-minute request thresholds and workload overrides. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
Contributor
📋 Pre-commit Output LogGenerated on Fri Sep 4 13:52:01 UTC 2026 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
azure_api_management.Requests,Duration,CpuPercent_Gateway,MemoryPercent_Gateway, and classic PremiumCapacitymetrics.alert_thresholdsprofile for each use case/SKU while preserving custommetric_alertsoverrides,{}disablement, and optionalaction_group_idrouting.Threshold profiles
Developer_1/development: profile is defined for completeness, but alerts remain disabled.StandardV2_1/cost_optimized: 10,000 total requests, 9,500 successful (2xx/3xx), 100 server-side failures (5xx), 50 unauthorized (401/403), 500 ms duration, and 80% gateway CPU/memory.Premium_2/high_load: 20,000 total requests, 19,000 successful (2xx/3xx), 200 server-side failures (5xx), 100 unauthorized (401/403), 500 ms duration, and 80% classic-tier capacity.The
Premium_2traffic profile doubles the four request thresholds relative to the one-unitStandardV2_1baseline. These are operational starting points, not Azure service limits, and should be tuned to the workload. Duration and resource thresholds remain percentage/latency baselines. HTTP 429 is Too Many Requests, not unauthorized, and is excluded; no separate throttling alert is added because it is not required by the ticket.Validation
terraform validateConsumer configuration
io-walletshould omitmetric_alertsto use defaults and passaction_group_idwhen alerts must notify an Azure Monitor Action Group.StandardV2_1receives Requests/Duration/CPU/Memory alerts;Premium_2receives Requests/Duration/Capacity alerts;Developer_1has no defaults.Resolves CES-2285