DS_ST_containerregistry-registries_DINE.json

{
  "properties": {
    "displayName": "Enable logging by category group for Container registries (microsoft.containerregistry/registries) to Storage",
    "description": "Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Storage Account for Container registries (microsoft.containerregistry/registries).",
    "mode": "Indexed",
    "policyType": "BuiltIn",
    "version": "1.1.0",
    "metadata": {
      "category": "Monitoring",
      "version": "1.1.0"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "DeployIfNotExists",
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "DeployIfNotExists"
      },
      "diagnosticSettingName": {
        "type": "String",
        "metadata": {
          "displayName": "Diagnostic Setting Name",
          "description": "Diagnostic Setting Name"
        },
        "defaultValue": "setByPolicy-Storage"
      },
      "categoryGroup": {
        "type": "String",
        "metadata": {
          "displayName": "Category Group",
          "description": "Diagnostic category group - none, audit, or allLogs."
        },
        "allowedValues": [
          "audit",
          "allLogs"
        ],
        "defaultValue": "audit"
      },
      "resourceLocation": {
        "type": "string",
        "metadata": {
          "displayName": "Resource Location",
          "description": "Resource Location must be in the same location as the Storage Account.",
          "strongType": "location"
        }
      },
      "storageAccount": {
        "type": "string",
        "metadata": {
          "displayName": "Storage Account",
          "description": "Full path (resourceId) to the storage account.",
          "assignPermissions": true
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "microsoft.containerregistry/registries"
          },
          {
            "field": "location",
            "equals": "[parameters('resourceLocation')]"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "evaluationDelay": "AfterProvisioning",
          "existenceCondition": {
            "allOf": [
              {
                "count": {
                  "field": "Microsoft.Insights/diagnosticSettings/logs[*]",
                  "where": {
                    "allOf": [
                      {
                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
                        "equals": "[equals(parameters('categoryGroup'), 'audit')]"
                      },
                      {
                        "field": "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
                        "equals": "audit"
                      }
                    ]
                  }
                },
                "equals": 1
              },
              {
                "count": {
                  "field": "Microsoft.Insights/diagnosticSettings/logs[*]",
                  "where": {
                    "allOf": [
                      {
                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
                        "equals": "[equals(parameters('categoryGroup'), 'allLogs')]"
                      },
                      {
                        "field": "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
                        "equals": "allLogs"
                      }
                    ]
                  }
                },
                "equals": 1
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/storageAccountId",
                "equals": "[parameters('storageAccount')]"
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "http://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "diagnosticSettingName": {
                    "type": "string"
                  },
                  "categoryGroup": {
                    "type": "String"
                  },
                  "storageAccount": {
                    "type": "string"
                  },
                  "resourceLocation": {
                    "type": "string"
                  },
                  "resourceName": {
                    "type": "string"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "microsoft.containerregistry/registries/providers/diagnosticSettings",
                    "apiVersion": "2021-05-01-preview",
                    "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('diagnosticSettingName'))]",
                    "location": "[parameters('resourceLocation')]",
                    "properties": {
                      "storageAccountId": "[parameters('storageAccount')]",
                      "logs": [
                        {
                          "categoryGroup": "audit",
                          "enabled": "[equals(parameters('categoryGroup'), 'audit')]"
                        },
                        {
                          "categoryGroup": "allLogs",
                          "enabled": "[equals(parameters('categoryGroup'), 'allLogs')]"
                        }
                      ],
                      "metrics": []
                    }
                  }
                ],
                "outputs": {
                  "policy": {
                    "type": "string",
                    "value": "[concat('Diagnostic setting ', parameters('diagnosticSettingName'), ' for type Container registries (microsoft.containerregistry/registries), resourceName ', parameters('resourceName'), ' to Storage Account ', parameters('storageAccount'), ' configured')]"
                  }
                }
              },
              "parameters": {
                "diagnosticSettingName": {
                  "value": "[parameters('diagnosticSettingName')]"
                },
                "categoryGroup": {
                  "value": "[parameters('categoryGroup')]"
                },
                "storageAccount": {
                  "value": "[parameters('storageAccount')]"
                },
                "resourceLocation": {
                  "value": "[field('location')]"
                },
                "resourceName": {
                  "value": "[field('name')]"
                }
              }
            }
          }
        }
      }
    },
    "versions": [
      "1.1.0",
      "1.0.0"
    ]
  },
  "name": "106cd3bd-50a1-466c-869f-f9c2d310477b",
  "id": "/providers/Microsoft.Authorization/policyDefinitions/106cd3bd-50a1-466c-869f-f9c2d310477b"
}