Moving Central Logging to a New Region

Overview

Diagnostic settings across a set of platform Terraform stacks (messaging, cache, security, edge, data and others) sent logs to workspaces in a different region from the workloads. I moved them to workspaces in the workload region, applying and verifying one environment at a time, and without forcing changes onto resources that had drifted outside Terraform.

Plan

Implementation

1. First attempt, reverted. The PR mixed module sources that needed different credentials, and pipelines holding only one of them failed at terraform init. I reverted it quickly and re-landed it with each pipeline on a source it could authenticate to.
2. Stacks on older modules got the new workspace ID through a small replace() local, rather than a risky module upgrade in the same change.
3. Each environment: plan review, apply, then confirm logs were actually arriving in the new workspace.
4. Drift held back. One edge stack carried unrelated drift, so I ran it plan-only and handed it to its owner instead of applying over their changes.

locals {
  law_id_target = replace(var.log_analytics_workspace_id, "-regiona-", "-regionb-")
}

resource "azurerm_monitor_diagnostic_setting" "this" {
  name                       = "diag-central"
  target_resource_id         = azurerm_redis_cache.this.id
  log_analytics_workspace_id = local.law_id_target
  enabled_log { category_group = "allLogs" }
}

Things I Found Along the Way

• A perpetual plan diff on the cache diagnostic setting (log_analytics_destination_type), fixed with the provider's opt-out flag.
• Logging resources that were never in Terraform: portal-created flow logs and auto-created data collection rules. I documented them so nobody expects code to manage them.
• A branch cut before other changes landed produced destroy plans. Merging main before planning fixed it.

Key Outcomes

• Several environments migrated and verified across every stack except the one deliberately held back.
• No unplanned destroys and no overwritten drift.
• A clear record of what is, and isn't, managed as code.

Lessons Learned

• Merge main before you plan. Stale branches produce frightening plans.
• Revert fast, re-land properly. A clean revert unblocks everyone while you fix it.
• Drift is information. Name an owner, and don't flatten it.

Conclusion

A wide, low-risk change is still a wide change. Rolling out one environment at a time and verifying each step made it boring, which is the goal.

Technologies Used