Merge pull request #80 from Azure-Samples/keyvault_auditing

Audit keyvault access via log analytics

Author: tonybaloney

{{cookiecutter.__src_folder_name}}/infra/core/security/keyvault.bicep

@@ -1,6 +1,7 @@
 metadata description = 'Creates an Azure Key Vault.'
 param name string
 param location string = resourceGroup().location
+param logAnalyticsWorkspaceId string
 param tags object = {}
 
 param principalId string = ''
@@ -35,6 +36,20 @@ resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' = {
   }
 }
 
+resource logs 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
+  name: 'logs'
+  scope: keyVault
+  properties: {
+    workspaceId: logAnalyticsWorkspaceId
+    logs: [
+      {
+        category: 'AuditEvent'
+        enabled: true
+      }
+    ]
+  }
+}
+
 output endpoint string = keyVault.properties.vaultUri
 output id string = keyVault.id
 output name string = keyVault.name

{{cookiecutter.__src_folder_name}}/infra/main.bicep

@@ -47,6 +47,7 @@ module keyVault './core/security/keyvault.bicep' = {
     location: location
     tags: tags
     principalId: principalId
+    logAnalyticsWorkspaceId: monitoring.outputs.logAnalyticsWorkspaceId
   }
 }