KeyVault_DeployDiagnosticLog_Deploy_LogAnalytics.json

{
  "properties": {
    "displayName": "Deploy Diagnostic Settings for Key Vault to Log Analytics workspace",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Deploys the diagnostic settings for Key Vault to stream to a regional Log Analytics workspace when any Key Vault which is missing this diagnostic settings is created or updated.",
    "metadata": {
      "version": "3.0.0",
      "category": "Monitoring"
    },
    "version": "3.0.0",
    "parameters": {
      "effect": {
        "type": "string",
        "defaultValue": "DeployIfNotExists",
        "allowedValues": [
          "DeployIfNotExists",
          "Disabled"
        ],
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        }
      },
      "profileName": {
        "type": "string",
        "defaultValue": "setbypolicy_logAnalytics",
        "metadata": {
          "displayName": "Profile name",
          "description": "The diagnostic settings profile name"
        }
      },
      "logAnalytics": {
        "type": "string",
        "metadata": {
          "displayName": "Log Analytics workspace",
          "description": "Select Log Analytics workspace from dropdown list. If this workspace is outside of the scope of the assignment you must manually grant 'Log Analytics Contributor' permissions (or similar) to the policy assignment's principal ID.",
          "strongType": "omsWorkspace",
          "assignPermissions": true
        }
      },
      "metricsEnabled": {
        "type": "string",
        "defaultValue": "False",
        "allowedValues": [
          "True",
          "False"
        ],
        "metadata": {
          "displayName": "Enable metrics",
          "description": "Whether to enable metrics stream to the Log Analytics workspace - True or False"
        }
      },
      "logsEnabled": {
        "type": "string",
        "defaultValue": "True",
        "allowedValues": [
          "True",
          "False"
        ],
        "metadata": {
          "displayName": "Enable logs",
          "description": "Whether to enable logs stream to the Log Analytics workspace - True or False"
        }
      },
      "matchWorkspace": {
        "type": "boolean",
        "defaultValue": false,
        "allowedValues": [
          true,
          false
        ],
        "metadata": {
          "displayName": "Workspace id must match",
          "description": "Whether to require that the workspace of the diagnostic settings matches the workspace deployed by this policy"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.KeyVault/vaults"
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "name": "[parameters('profileName')]",
          "evaluationDelay": "AfterProvisioning",
          "existenceCondition": {
            "allOf": [
              {
                "count": {
                  "field": "Microsoft.Insights/diagnosticSettings/logs[*]",
                  "where": {
                    "allOf": [
                      {
                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
                        "equals": "[parameters('logsEnabled')]"
                      },
                      {
                        "field": "Microsoft.Insights/diagnosticSettings/logs[*].category",
                        "equals": "AuditEvent"
                      }
                    ]
                  }
                },
                "greaterOrEquals": 1
              },
              {
                "count": {
                  "field": "Microsoft.Insights/diagnosticSettings/metrics[*]",
                  "where": {
                    "field": "Microsoft.Insights/diagnosticSettings/metrics[*].enabled",
                    "equals": "[parameters('metricsEnabled')]"
                  }
                },
                "greaterOrEquals": 1
              },
              {
                "anyOf": [
                  {
                    "value": "[parameters('matchWorkspace')]",
                    "equals": false
                  },
                  {
                    "field": "Microsoft.Insights/diagnosticSettings/workspaceId",
                    "equals": "[parameters('logAnalytics')]"
                  }
                ]
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/microsoft.authorization/roleDefinitions/749f88d5-cbae-40b8-bcfc-e573ddc772fa",
            "/providers/microsoft.authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "resourceName": {
                    "type": "string"
                  },
                  "location": {
                    "type": "string"
                  },
                  "logAnalytics": {
                    "type": "string"
                  },
                  "metricsEnabled": {
                    "type": "string"
                  },
                  "logsEnabled": {
                    "type": "string"
                  },
                  "profileName": {
                    "type": "string"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.KeyVault/vaults/providers/diagnosticSettings",
                    "apiVersion": "2017-05-01-preview",
                    "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('profileName'))]",
                    "location": "[parameters('location')]",
                    "dependsOn": [],
                    "properties": {
                      "workspaceId": "[parameters('logAnalytics')]",
                      "metrics": [
                        {
                          "category": "AllMetrics",
                          "enabled": "[parameters('metricsEnabled')]",
                          "retentionPolicy": {
                            "enabled": false,
                            "days": 0
                          }
                        }
                      ],
                      "logs": [
                        {
                          "category": "AuditEvent",
                          "enabled": "[parameters('logsEnabled')]"
                        },
                        {
                          "category": "AzurePolicyEvaluationDetails",
                          "enabled": "[parameters('logsEnabled')]"
                        }
                      ]
                    }
                  }
                ],
                "outputs": {}
              },
              "parameters": {
                "location": {
                  "value": "[field('location')]"
                },
                "resourceName": {
                  "value": "[field('name')]"
                },
                "logAnalytics": {
                  "value": "[parameters('logAnalytics')]"
                },
                "metricsEnabled": {
                  "value": "[parameters('metricsEnabled')]"
                },
                "logsEnabled": {
                  "value": "[parameters('logsEnabled')]"
                },
                "profileName": {
                  "value": "[parameters('profileName')]"
                }
              }
            }
          }
        }
      }
    },
    "versions": [
      "3.0.0"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/bef3f64c-5290-43b7-85b0-9b254eef4c47",
  "name": "bef3f64c-5290-43b7-85b0-9b254eef4c47"
}