DiagSettings_logAnalytics_firewall_DINE.json

{
  "properties": {
    "displayName": "Enable logging by category group for Firewall (microsoft.network/azurefirewalls) to Log Analytics",
    "description": "Resource logs should be enabled to track activities and events that take place on your resources and give you visibility and insights into any changes that occur. This policy deploys a diagnostic setting using a category group to route logs to a Log Analytics workspace for Firewall (microsoft.network/azurefirewalls).",
    "mode": "Indexed",
    "policyType": "BuiltIn",
    "version": "1.0.0",
    "metadata": {
      "version": "1.0.0",
      "category": "Monitoring"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "DeployIfNotExists",
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "DeployIfNotExists"
      },
      "diagnosticSettingName": {
        "type": "String",
        "metadata": {
          "displayName": "Diagnostic Setting Name",
          "description": "Diagnostic Setting Name"
        },
        "defaultValue": "setByPolicy-LogAnalytics"
      },
      "resourceLocationList": {
        "type": "array",
        "metadata": {
          "displayName": "Resource Location List",
          "description": "Resource Location List to send logs to nearby Log Analytics. A single entry \"*\" selects all locations (default)."
        },
        "defaultValue": [
          "*"
        ]
      },
      "logAnalytics": {
        "type": "string",
        "metadata": {
          "displayName": "Log Analytics Workspace",
          "description": "Log Analytics Workspace",
          "strongType": "omsWorkspace",
          "assignPermissions": true
        }
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "microsoft.network/azurefirewalls"
          },
          {
            "anyOf": [
              {
                "value": "[first(parameters('resourceLocationList'))]",
                "equals": "*"
              },
              {
                "field": "location",
                "in": "[parameters('resourceLocationList')]"
              }
            ]
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "existenceCondition": {
            "allOf": [
              {
                "count": {
                  "field": "Microsoft.Insights/diagnosticSettings/logs[*]",
                  "where": {
                    "allOf": [
                      {
                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
                        "equals": true
                      },
                      {
                        "field": "microsoft.insights/diagnosticSettings/logs[*].categoryGroup",
                        "equals": "allLogs"
                      }
                    ]
                  }
                },
                "equals": 1
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/workspaceId",
                "equals": "[parameters('logAnalytics')]"
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "diagnosticSettingName": {
                    "type": "string"
                  },
                  "logAnalytics": {
                    "type": "string"
                  },
                  "resourceName": {
                    "type": "string"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "microsoft.network/azurefirewalls/providers/diagnosticSettings",
                    "apiVersion": "2021-05-01-preview",
                    "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('diagnosticSettingName'))]",
                    "properties": {
                      "workspaceId": "[parameters('logAnalytics')]",
                      "logs": [
                        {
                          "categoryGroup": "allLogs",
                          "enabled": true
                        }
                      ],
                      "metrics": []
                    }
                  }
                ],
                "outputs": {
                  "policy": {
                    "type": "string",
                    "value": "[concat('Diagnostic setting ', parameters('diagnosticSettingName'), ' for type Firewall (microsoft.network/azurefirewalls), resourceName ', parameters('resourceName'), ' to Log Analytics ', parameters('logAnalytics'), ' configured')]"
                  }
                }
              },
              "parameters": {
                "diagnosticSettingName": {
                  "value": "[parameters('diagnosticSettingName')]"
                },
                "logAnalytics": {
                  "value": "[parameters('logAnalytics')]"
                },
                "resourceName": {
                  "value": "[field('name')]"
                }
              }
            }
          }
        }
      }
    },
    "versions": [
      "1.0.0"
    ]
  },
  "name": "a4490248-cb97-4504-b7fb-f906afdb7437",
  "id": "/providers/Microsoft.Authorization/policyDefinitions/a4490248-cb97-4504-b7fb-f906afdb7437"
}