Skip to content

Commit fa8afcb

Browse files
thotheodthotheod
authored
fix diagnotics changes (#180)
* fix diag settings for azFW * fix: diagnostics settings
1 parent db86b1e commit fa8afcb

File tree

11 files changed

+237
-513
lines changed

11 files changed

+237
-513
lines changed

‎scenarios/secure-baseline-multitenant/azure-resource-manager/main.json

Lines changed: 227 additions & 326 deletions
Large diffs are not rendered by default.

‎scenarios/secure-baseline-multitenant/azure-resource-manager/main.parameters.jsonc

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,27 +24,27 @@
2424
// Feature Flags
2525
// set to true if you want to intercept all outbound traffic with azure firewall
2626
"enableEgressLockdown" : {
27-
"value": "true"
27+
"value": true
2828
},
2929
// set to true if you want to a redis cache
3030
"deployRedis": {
31-
"value": "false"
31+
"value": true
3232
},
3333
// set to true if you want to deploy a azure SQL server and default database
3434
"deployAzureSql": {
35-
"value": "true"
35+
"value": true
3636
},
3737
// set to true if you want to deploy application configuration
3838
"deployAppConfig": {
39-
"value": "true"
39+
"value": true
4040
},
4141
// set to true if you want to deploy a jumpbox/devops VM
4242
"deployJumpHost": {
43-
"value": "true"
43+
"value": true
4444
},
4545
// set to true if you want to auto approve the Private Endpoint of the AFD Premium
4646
"autoApproveAfdPrivateEndpoint": {
47-
"value": "true"
47+
"value": true
4848
},
4949
// CIDR of the subnet that will host the azure Firewall
5050
"subnetHubFirewallAddressSpace": {

‎scenarios/secure-baseline-multitenant/bicep/main.parameters.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"contentVersion": "1.0.0.0",
44
"parameters": {
55
"workloadName" : {
6-
"value": "appsvclza2"
6+
"value": "appsvclza1"
77
},
88
"environmentName": {
99
"value": "${AZURE_ENV_NAME}"
@@ -24,13 +24,13 @@
2424
"value": false
2525
},
2626
"deployAzureSql": {
27-
"value": true
27+
"value": false
2828
},
2929
"deployAppConfig": {
3030
"value": false
3131
},
3232
"deployJumpHost": {
33-
"value": true
33+
"value": false
3434
},
3535
"autoApproveAfdPrivateEndpoint": {
3636
"value": true

‎scenarios/secure-baseline-multitenant/bicep/main.parameters.jsonc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
},
3333
// set to true if you want to deploy a azure SQL server and default database
3434
"deployAzureSql": {
35-
"value": "true"
35+
"value": true
3636
},
3737
// set to true if you want to deploy application configuration
3838
"deployAppConfig": {

‎scenarios/shared/bicep/app-services/app-service-plan.bicep

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,6 @@ param targetWorkerSize int = 0
4949
@description('Optional. The name of the diagnostic setting, if deployed.')
5050
param diagnosticSettingsName string = '${name}-diagnosticSettings'
5151

52-
@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
53-
@minValue(0)
54-
@maxValue(365)
55-
param diagnosticLogsRetentionInDays int = 365
56-
5752
@description('Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.')
5853
param diagnosticWorkspaceId string = ''
5954

@@ -80,10 +75,6 @@ var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
8075
category: metric
8176
timeGrain: null
8277
enabled: true
83-
retentionPolicy: {
84-
enabled: true
85-
days: diagnosticLogsRetentionInDays
86-
}
8778
}]
8879

8980
// https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/patterns-configuration-set#example

‎scenarios/shared/bicep/app-services/web-app.bicep

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,6 @@ param slots array = []
7474
param tags object = {}
7575

7676
// Diagnostic Settings
77-
@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
78-
@minValue(0)
79-
@maxValue(365)
80-
param diagnosticLogsRetentionInDays int = 365
8177

8278
@description('Optional. Resource ID of log analytics workspace.')
8379
param diagnosticWorkspaceId string = ''
@@ -151,31 +147,19 @@ param redundancyMode string = 'None'
151147
var diagnosticsLogsSpecified = [for category in filter(diagnosticLogCategoriesToEnable, item => item != 'allLogs'): {
152148
category: category
153149
enabled: true
154-
retentionPolicy: {
155-
enabled: true
156-
days: diagnosticLogsRetentionInDays
157-
}
158150
}]
159151

160152
var diagnosticsLogs = contains(diagnosticLogCategoriesToEnable, 'allLogs') ? [
161153
{
162154
categoryGroup: 'allLogs'
163155
enabled: true
164-
retentionPolicy: {
165-
enabled: true
166-
days: diagnosticLogsRetentionInDays
167-
}
168156
}
169157
] : diagnosticsLogsSpecified
170158

171159
var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
172160
category: metric
173161
timeGrain: null
174162
enabled: true
175-
retentionPolicy: {
176-
enabled: true
177-
days: diagnosticLogsRetentionInDays
178-
}
179163
}]
180164

181165
var identityType = systemAssignedIdentity ? (!empty(userAssignedIdentities) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned') : (!empty(userAssignedIdentities) ? 'UserAssigned' : 'None')
@@ -315,7 +299,6 @@ module app_slots 'web-app.slots.bicep' = [for (slot, index) in slots: {
315299
storageAccountId: contains(slot, 'storageAccountId') ? slot.storageAccountId : storageAccountId
316300
appInsightId: contains(slot, 'appInsightId') ? slot.appInsightId : appInsightId
317301
setAzureWebJobsDashboard: contains(slot, 'setAzureWebJobsDashboard') ? slot.setAzureWebJobsDashboard : setAzureWebJobsDashboard
318-
diagnosticLogsRetentionInDays: contains(slot, 'diagnosticLogsRetentionInDays') ? slot.diagnosticLogsRetentionInDays : diagnosticLogsRetentionInDays
319302
diagnosticWorkspaceId: diagnosticWorkspaceId
320303
diagnosticLogCategoriesToEnable: contains(slot, 'diagnosticLogCategoriesToEnable') ? slot.diagnosticLogCategoriesToEnable : diagnosticLogCategoriesToEnable
321304
diagnosticMetricsToEnable: contains(slot, 'diagnosticMetricsToEnable') ? slot.diagnosticMetricsToEnable : diagnosticMetricsToEnable

‎scenarios/shared/bicep/app-services/web-app.slots.bicep

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,6 @@ param appSettingsKeyValuePairs object = {}
7171
param tags object = {}
7272

7373
// Diagnostic Settings
74-
@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
75-
@minValue(0)
76-
@maxValue(365)
77-
param diagnosticLogsRetentionInDays int = 365
78-
7974
@description('Optional. Resource ID of log analytics workspace.')
8075
param diagnosticWorkspaceId string = ''
8176

@@ -160,20 +155,12 @@ param vnetRouteAllEnabled bool = false
160155
var diagnosticsLogs = [for category in diagnosticLogCategoriesToEnable: {
161156
category: category
162157
enabled: true
163-
retentionPolicy: {
164-
enabled: true
165-
days: diagnosticLogsRetentionInDays
166-
}
167158
}]
168159

169160
var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
170161
category: metric
171162
timeGrain: null
172163
enabled: true
173-
retentionPolicy: {
174-
enabled: true
175-
days: diagnosticLogsRetentionInDays
176-
}
177164
}]
178165

179166
var identityType = systemAssignedIdentity ? (!empty(userAssignedIdentities) ? 'SystemAssigned,UserAssigned' : 'SystemAssigned') : (!empty(userAssignedIdentities) ? 'UserAssigned' : 'None')

‎scenarios/shared/bicep/databases/redis.bicep

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,6 @@ param subnetId string = ''
6262
@description('Optional. The name of the diagnostic setting, if deployed.')
6363
param diagnosticSettingsName string = '${name}-diagnosticSettings'
6464

65-
@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
66-
@minValue(0)
67-
@maxValue(365)
68-
param diagnosticLogsRetentionInDays int = 365
69-
7065
@description('Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.')
7166
param diagnosticWorkspaceId string = ''
7267

@@ -93,31 +88,19 @@ param hasPrivateLink bool = false
9388
var diagnosticsLogsSpecified = [for category in filter(diagnosticLogCategoriesToEnable, item => item != 'allLogs'): {
9489
category: category
9590
enabled: true
96-
retentionPolicy: {
97-
enabled: true
98-
days: diagnosticLogsRetentionInDays
99-
}
10091
}]
10192

10293
var diagnosticsLogs = contains(diagnosticLogCategoriesToEnable, 'allLogs') ? [
10394
{
10495
categoryGroup: 'allLogs'
10596
enabled: true
106-
retentionPolicy: {
107-
enabled: true
108-
days: diagnosticLogsRetentionInDays
109-
}
11097
}
11198
] : diagnosticsLogsSpecified
11299

113100
var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
114101
category: metric
115102
timeGrain: null
116103
enabled: true
117-
retentionPolicy: {
118-
enabled: true
119-
days: diagnosticLogsRetentionInDays
120-
}
121104
}]
122105

123106
// var identityType = systemAssignedIdentity ? 'SystemAssigned' : !empty(userAssignedIdentities) ? 'UserAssigned' : 'None'

‎scenarios/shared/bicep/network/firewall.bicep

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -52,11 +52,6 @@ param diagnosticStorageAccountId string = ''
5252
@description('Optional. Log Analytics workspace resource identifier.')
5353
param diagnosticWorkspaceId string = ''
5454

55-
@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
56-
@minValue(0)
57-
@maxValue(365)
58-
param diagnosticLogsRetentionInDays int = 365
59-
6055
@description('Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to.')
6156
param diagnosticEventHubAuthorizationRuleId string = ''
6257

@@ -96,31 +91,19 @@ var azureSkuName = 'AZFW_VNet'
9691
var diagnosticsLogsSpecified = [for category in filter(diagnosticLogCategoriesToEnable, item => item != 'allLogs'): {
9792
category: category
9893
enabled: true
99-
retentionPolicy: {
100-
enabled: true
101-
days: diagnosticLogsRetentionInDays
102-
}
10394
}]
10495

10596
var diagnosticsLogs = contains(diagnosticLogCategoriesToEnable, 'allLogs') ? [
10697
{
10798
categoryGroup: 'allLogs'
10899
enabled: true
109-
retentionPolicy: {
110-
enabled: true
111-
days: diagnosticLogsRetentionInDays
112-
}
113100
}
114101
] : diagnosticsLogsSpecified
115102

116103
var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
117104
category: metric
118105
timeGrain: null
119106
enabled: true
120-
retentionPolicy: {
121-
enabled: true
122-
days: diagnosticLogsRetentionInDays
123-
}
124107
}]
125108

126109
var ipConfigurations = [{

‎scenarios/shared/bicep/network/front-door.bicep

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -61,11 +61,6 @@ param wafPolicyMode string = 'Prevention'
6161
@description('if no diagnostic serttings are required, provide an empty string. Resource ID of log analytics workspace.')
6262
param diagnosticWorkspaceId string
6363

64-
@description('Optional. Specifies the number of days that logs will be kept for; a value of 0 will retain data indefinitely.')
65-
@minValue(0)
66-
@maxValue(365)
67-
param diagnosticLogsRetentionInDays int = 365
68-
6964
// Create an Array of all Endpoint which includes customDomain Id and afdEndpoint Id
7065
// This array is needed to be attached to Microsoft.Cdn/profiles/securitypolicies
7166
// var customDomainIds = [for (domain, index) in customDomains: {id: custom_domains[index].id}]
@@ -140,31 +135,19 @@ param diagnosticMetricsToEnable array = [
140135
var diagnosticsLogsSpecified = [for category in filter(diagnosticLogCategoriesToEnable, item => item != 'allLogs'): {
141136
category: category
142137
enabled: true
143-
retentionPolicy: {
144-
enabled: true
145-
days: diagnosticLogsRetentionInDays
146-
}
147138
}]
148139

149140
var diagnosticsLogs = contains(diagnosticLogCategoriesToEnable, 'allLogs') ? [
150141
{
151142
categoryGroup: 'allLogs'
152143
enabled: true
153-
retentionPolicy: {
154-
enabled: true
155-
days: diagnosticLogsRetentionInDays
156-
}
157144
}
158145
] : diagnosticsLogsSpecified
159146

160147
var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
161148
category: metric
162149
timeGrain: null
163150
enabled: true
164-
retentionPolicy: {
165-
enabled: true
166-
days: diagnosticLogsRetentionInDays
167-
}
168151
}]
169152

170153
@description('Optional. The name of the diagnostic setting, if deployed.')

0 commit comments

Comments
 (0)