Created
January 4, 2021 14:38
-
-
Save ehrnst/951053c9b803636863296457ad500093 to your computer and use it in GitHub Desktop.
Mangagement group arm template to deploy policy for subscription diagnostics
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#", | |
| "contentVersion": "1.0.0.0", | |
| "parameters": { | |
| "assignmentMgmtGroupId": { | |
| "type": "string" | |
| }, | |
| "workspaceId": { | |
| "type": "string" | |
| }, | |
| "rbacGuid": { | |
| "type": "string", | |
| "defaultValue": "[concat(guid('azpolicy', tenantResourceId('Microsoft.Management/managementGroups', parameters('assignmentMgmtGroupId'))))]" | |
| }, | |
| "enableRemediation": { | |
| "type": "string", | |
| "allowedValues": [ | |
| "Yes", | |
| "No" | |
| ], | |
| "defaultValue": "Yes" | |
| } | |
| }, | |
| "variables": { | |
| "policyDefinitionName": "enable-subDiag", | |
| "policyAssignmentName": "deplyIfNot-subDiag", | |
| "policyDefinitionDisplayName": "Enable subscription diagnostic settings", | |
| "policyAssignmentDisplayName": "Ensure subscription audit logs are sent to log analytics", | |
| "rbacRoleId": "b24988ac-6180-42a0-ab88-20f7382dd24c" | |
| }, | |
| "resources": [ | |
| { | |
| "type": "Microsoft.Authorization/policyDefinitions", | |
| "apiVersion": "2019-09-01", | |
| "name": "[variables('policyDefinitionName')]", | |
| "properties": { | |
| "displayName": "[variables('policyDefinitionDisplayName')]", | |
| "policyType": "Custom", | |
| "metadata": { | |
| "category": "General" | |
| }, | |
| "mode": "All", | |
| "description": "Ensures that Activity Log Diagnostics settings are set to push logs into Log Analytics", | |
| "parameters": { | |
| "workspaceId": { | |
| "type": "String", | |
| "metadata": { | |
| "displayName": "Primary Log Analytics workspace", | |
| "description": "Select Log Analytics workspace from dropdown list", | |
| "strongType": "omsWorkspace" | |
| } | |
| } | |
| }, | |
| "policyRule": { | |
| "if": { | |
| "allOf": [ | |
| { | |
| "field": "type", | |
| "equals": "Microsoft.Resources/subscriptions" | |
| } | |
| ] | |
| }, | |
| "then": { | |
| "effect": "deployIfNotExists", | |
| "details": { | |
| "type": "Microsoft.Insights/diagnosticSettings", | |
| "deploymentScope": "Subscription", | |
| "existenceScope": "Subscription", | |
| "roleDefinitionIds": [ | |
| "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" | |
| ], | |
| "existenceCondition": { | |
| "allOf": [ | |
| { | |
| "field": "Microsoft.Insights/diagnosticSettings/workspaceId", | |
| "equals": "[[parameters('workspaceId')]" | |
| } | |
| ] | |
| }, | |
| "deployment": { | |
| "location": "[deployment().location]", | |
| "properties": { | |
| "mode": "incremental", | |
| "template": { | |
| "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#", | |
| "contentVersion": "1.0.0.0", | |
| "parameters": { | |
| "workspaceId": { | |
| "type": "string" | |
| } | |
| }, | |
| "variables": {}, | |
| "resources": [ | |
| { | |
| "name": "subscriptionLogsToLogAnalytics", | |
| "type": "Microsoft.Insights/diagnosticSettings", | |
| "apiVersion": "2017-05-01-preview", | |
| "location": "Global", | |
| "properties": { | |
| "workspaceId": "[[parameters('workspaceId')]", | |
| "logs": [ | |
| { | |
| "category": "Administrative", | |
| "enabled": true | |
| }, | |
| { | |
| "category": "Security", | |
| "enabled": true | |
| } | |
| ] | |
| } | |
| } | |
| ], | |
| "outputs": {} | |
| }, | |
| "parameters": { | |
| "workspaceId": { | |
| "value": "[[parameters('workspaceId')]" | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| { | |
| "type": "Microsoft.Authorization/policyAssignments", | |
| "apiVersion": "2018-05-01", | |
| "name": "[variables('policyAssignmentName')]", | |
| "location": "[deployment().location]", | |
| "dependsOn": [ | |
| "[variables('policyDefinitionName')]" | |
| ], | |
| "identity": { | |
| "type": "SystemAssigned" | |
| }, | |
| "properties": { | |
| "description": "[variables('policyAssignmentName')]", | |
| "displayName": "[variables('policyAssignmentDisplayName')]", | |
| "scope": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('assignmentMgmtGroupId'))]", | |
| "policyDefinitionId": "[concat('/providers/Microsoft.Management/managementGroups/edcf3e2a-33d4-4872-84df-c1782622fca7', '/providers/Microsoft.Authorization/policyDefinitions/', variables('policyDefinitionName'))]", | |
| "parameters": { | |
| "workspaceId": { | |
| "value": "[toLower(parameters('workspaceId'))]" | |
| } | |
| } | |
| } | |
| }, | |
| { | |
| "type": "Microsoft.Authorization/roleAssignments", | |
| "apiVersion": "2020-04-01-preview", | |
| "name": "[parameters('rbacGuid')]", | |
| "dependsOn": [ | |
| "[variables('policyAssignmentName')]" | |
| ], | |
| "properties": { | |
| "principalType": "ServicePrincipal", | |
| "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacRoleId'))]", | |
| "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentName')), '2018-05-01', 'Full' ).identity.principalId)]" | |
| } | |
| }, | |
| { | |
| "condition": "[equals(parameters('enableRemediation'), 'Yes')]", | |
| "type": "Microsoft.PolicyInsights/remediations", | |
| "apiVersion": "2019-07-01", | |
| "name": "subLogRemediation", | |
| "dependsOn": [ | |
| "[parameters('rbacGuid')]" | |
| ], | |
| "properties": { | |
| "policyAssignmentId": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('assignmentMgmtGroupId'), '/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentName'))]" | |
| } | |
| } | |
| ], | |
| "outputs": {} | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment