Skip to content

Commit 2b9508d

Browse files
taoyangcloudCopilot
taoyangcloud
and
Copilot
committed
Refactor diagnostic settings policies to use parameterized log and metric enabling
- Updated multiple diagnostic settings JSON files to replace hardcoded values for logs and metrics enabling with parameters. - Introduced a new parameter `DS-008_LogsToEnable` to specify which logs should be enabled. - Modified existence conditions to check for the count of enabled logs under the category group "allLogs". - Ensured consistency across various resource types in the policy definitions for better maintainability and flexibility. Co-authored-by: Copilot <copilot@github.com>
1 parent 5018990 commit 2b9508d

66 files changed

Lines changed: 900 additions & 291 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎policyAssignments/dev/pa-d-diag-settings.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@
4343
"DS-008_Effect": {
4444
"value": "DeployIfNotExists"
4545
},
46+
"DS-008_LogsToEnable": {
47+
"value": [
48+
"AppSystemEvents",
49+
"OTelResources"
50+
]
51+
},
4652
"DS-009_Effect": {
4753
"value": "DeployIfNotExists"
4854
},

‎policyAssignments/prod/pa-p-diag-settings.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@
4343
"DS-008_Effect": {
4444
"value": "DeployIfNotExists"
4545
},
46+
"DS-008_LogsToEnable": {
47+
"value": [
48+
"AppSystemEvents",
49+
"OTelResources"
50+
]
51+
},
4652
"DS-009_Effect": {
4753
"value": "DeployIfNotExists"
4854
},

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-aa.json‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,12 +90,26 @@
9090
"existenceCondition": {
9191
"allOf": [
9292
{
93-
"field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
94-
"equals": "True"
93+
"count": {
94+
"field": "Microsoft.Insights/diagnosticSettings/logs[*]",
95+
"where": {
96+
"allOf": [
97+
{
98+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].categoryGroup",
99+
"equals": "allLogs"
100+
},
101+
{
102+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
103+
"equals": "[parameters('logsEnabled')]"
104+
}
105+
]
106+
}
107+
},
108+
"equals": 1
95109
},
96110
{
97111
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
98-
"equals": "True"
112+
"equals": "[parameters('metricsEnabled')]"
99113
},
100114
{
101115
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-aci.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@
7979
"allOf": [
8080
{
8181
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
82-
"equals": "True"
82+
"equals": "[parameters('metricsEnabled')]"
8383
},
8484
{
8585
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-acr.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,13 +100,17 @@
100100
},
101101
{
102102
"field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
103-
"equals": "true"
103+
"equals": "[parameters('logsEnabled')]"
104104
}
105105
]
106106
}
107107
},
108108
"equals": 1
109109
},
110+
{
111+
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
112+
"equals": "[parameters('metricsEnabled')]"
113+
},
110114
{
111115
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",
112116
"matchInsensitively": "[parameters('logAnalytics')]"

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-aks.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,11 +103,11 @@
103103
"allOf": [
104104
{
105105
"field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
106-
"equals": "True"
106+
"equals": "[parameters('logsEnabled')]"
107107
},
108108
{
109109
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
110-
"equals": "True"
110+
"equals": "[parameters('metricsEnabled')]"
111111
},
112112
{
113113
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-analysisService.json‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,12 +90,26 @@
9090
"existenceCondition": {
9191
"allOf": [
9292
{
93-
"field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
94-
"equals": "True"
93+
"count": {
94+
"field": "Microsoft.Insights/diagnosticSettings/logs[*]",
95+
"where": {
96+
"allOf": [
97+
{
98+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].categoryGroup",
99+
"equals": "allLogs"
100+
},
101+
{
102+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
103+
"equals": "[parameters('logsEnabled')]"
104+
}
105+
]
106+
}
107+
},
108+
"equals": 1
95109
},
96110
{
97111
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
98-
"equals": "True"
112+
"equals": "[parameters('metricsEnabled')]"
99113
},
100114
{
101115
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-apim.json‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,12 +102,26 @@
102102
"existenceCondition": {
103103
"allOf": [
104104
{
105-
"field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
106-
"equals": "True"
105+
"count": {
106+
"field": "Microsoft.Insights/diagnosticSettings/logs[*]",
107+
"where": {
108+
"allOf": [
109+
{
110+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].categoryGroup",
111+
"equals": "allLogs"
112+
},
113+
{
114+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
115+
"equals": "[parameters('logsEnabled')]"
116+
}
117+
]
118+
}
119+
},
120+
"equals": 1
107121
},
108122
{
109123
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
110-
"equals": "True"
124+
"equals": "[parameters('metricsEnabled')]"
111125
},
112126
{
113127
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-appGW.json‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -90,12 +90,26 @@
9090
"existenceCondition": {
9191
"allOf": [
9292
{
93-
"field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
94-
"equals": "True"
93+
"count": {
94+
"field": "Microsoft.Insights/diagnosticSettings/logs[*]",
95+
"where": {
96+
"allOf": [
97+
{
98+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].categoryGroup",
99+
"equals": "allLogs"
100+
},
101+
{
102+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
103+
"equals": "[parameters('logsEnabled')]"
104+
}
105+
]
106+
}
107+
},
108+
"equals": 1
95109
},
96110
{
97111
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
98-
"equals": "True"
112+
"equals": "[parameters('metricsEnabled')]"
99113
},
100114
{
101115
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",

‎policyDefinitions/diagnostics-settings/pol-deploy-diag-appInsights.json‎

Lines changed: 33 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
2-
"name": "pol-deploy-diag-appInsights",
2+
"name": "pol-deploy-diag-appins-law-contoso-poc",
33
"properties": {
4-
"displayName": "Deploy the diagnostic settings for AppInsights to Log Analytics workspace",
4+
"displayName": "Configure Diagnostic Settings for AppInsights to Log Analytics workspace",
55
"description": "This policy automatically deploys and enable diagnostic settings to Log Analytics",
66
"metadata": {
77
"category": "Logging and monitoring",
@@ -39,15 +39,6 @@
3939
],
4040
"defaultValue": "DeployIfNotExists"
4141
},
42-
"logAnalytics": {
43-
"type": "string",
44-
"metadata": {
45-
"displayName": "Log Analytics workspace",
46-
"description": "Select the Log Analytics workspace from dropdown list",
47-
"strongType": "omsWorkspace",
48-
"assignPermissions": true
49-
}
50-
},
5142
"metricsEnabled": {
5243
"type": "string",
5344
"metadata": {
@@ -60,17 +51,16 @@
6051
],
6152
"defaultValue": "True"
6253
},
63-
"logsEnabled": {
64-
"type": "string",
54+
"logsToEnable": {
55+
"type": "array",
6556
"metadata": {
66-
"displayName": "Enable logs",
67-
"description": "Whether to enable logs stream to the Log Analytics workspace - True or False"
57+
"displayName": "Logs to be enable",
58+
"description": "Diagnostic logs to be enabled"
6859
},
69-
"allowedValues": [
70-
"True",
71-
"False"
72-
],
73-
"defaultValue": "True"
60+
"defaultValue": [
61+
"AppSystemEvents",
62+
"OTelResources"
63+
]
7464
}
7565
},
7666
"policyRule": {
@@ -90,16 +80,22 @@
9080
"existenceCondition": {
9181
"allOf": [
9282
{
93-
"field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
94-
"equals": "True"
83+
"count": {
84+
"field": "Microsoft.Insights/diagnosticSettings/logs[*]",
85+
"where": {
86+
"field": "Microsoft.Insights/diagnosticSettings/logs[*].category",
87+
"in": "[parameters('logsToEnable')]"
88+
}
89+
},
90+
"equals": "[length(parameters('logsToEnable'))]"
9591
},
9692
{
97-
"field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
98-
"equals": "True"
93+
"field": "Microsoft.Insights/diagnosticSettings/metrics[*].enabled",
94+
"equals": "[parameters('metricsEnabled')]"
9995
},
10096
{
10197
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",
102-
"matchInsensitively": "[parameters('logAnalytics')]"
98+
"matchInsensitively": "[field('Microsoft.Insights/Components/WorkspaceResourceId')]"
10399
}
104100
]
105101
},
@@ -116,14 +112,11 @@
116112
"resourceName": {
117113
"type": "string"
118114
},
119-
"logAnalytics": {
120-
"type": "string"
121-
},
122115
"metricsEnabled": {
123116
"type": "string"
124117
},
125-
"logsEnabled": {
126-
"type": "string"
118+
"logsToEnable": {
119+
"type": "array"
127120
},
128121
"location": {
129122
"type": "string"
@@ -138,7 +131,7 @@
138131
"location": "[parameters('location')]",
139132
"dependsOn": [],
140133
"properties": {
141-
"workspaceId": "[parameters('logAnalytics')]",
134+
"workspaceId": "[reference(resourceId('Microsoft.Insights/Components', parameters('resourceName')), '2020-02-02', 'Full').properties.WorkspaceResourceId]",
142135
"metrics": [
143136
{
144137
"category": "AllMetrics",
@@ -150,10 +143,14 @@
150143
"timeGrain": null
151144
}
152145
],
153-
"logs": [
146+
"copy": [
154147
{
155-
"categoryGroup": "allLogs",
156-
"enabled": "[parameters('logsEnabled')]"
148+
"name": "logs",
149+
"count": "[length(parameters('logsToEnable'))]",
150+
"input": {
151+
"category": "[parameters('logsToEnable')[copyIndex('logs')]]",
152+
"enabled": "True"
153+
}
157154
}
158155
]
159156
}
@@ -165,14 +162,11 @@
165162
"profileName": {
166163
"value": "[parameters('profileName')]"
167164
},
168-
"logAnalytics": {
169-
"value": "[parameters('logAnalytics')]"
170-
},
171165
"metricsEnabled": {
172166
"value": "[parameters('metricsEnabled')]"
173167
},
174-
"logsEnabled": {
175-
"value": "[parameters('logsEnabled')]"
168+
"logsToEnable": {
169+
"value": "[parameters('logsToEnable')]"
176170
},
177171
"location": {
178172
"value": "[field('location')]"

0 commit comments

Comments
 (0)