Azure Monitor Diagnostic Setting
This page shows how to write Terraform and Azure Resource Manager for Monitor Diagnostic Setting and write them securely.
azurerm_monitor_diagnostic_setting (Terraform)
The Diagnostic Setting in Monitor can be configured in Terraform with the resource name azurerm_monitor_diagnostic_setting
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_monitor_diagnostic_setting" "cosmosdb" {
name = "diag"
target_resource_id = azurerm_cosmosdb_account.cqrs_db.id
log_analytics_workspace_id = azurerm_log_analytics_workspace.cqrs_logs.id
log {
resource "azurerm_monitor_diagnostic_setting" "appgw-diagnostics" {
name = "diag2law"
target_resource_id = azurerm_application_gateway.appgw.id
log_analytics_workspace_id = azurerm_log_analytics_workspace.law.id
log {
resource "azurerm_monitor_diagnostic_setting" "settings" {
name = "DiagnosticsSettings"
target_resource_id = var.aks_cluster_id
log_analytics_workspace_id = var.log_analytics_workspace_id
log {
resource "azurerm_monitor_diagnostic_setting" "vnet_diagnostics" {
name = "vnet_diagnostics"
target_resource_id = module.network.id
log_analytics_workspace_id = data.terraform_remote_state.central_resources.outputs.log_analytics_id
log {
resource "azurerm_monitor_diagnostic_setting" "kv-worksapce" {
name = "log_analytics"
target_resource_id = azurerm_key_vault.kv.id
log_analytics_workspace_id = var.log_analytics_workspace
log {
resource "azurerm_monitor_diagnostic_setting" "appgw_pip" {
count = var.log_analytics_workspace_id != null ? 1 : 0
name = "appgw-pip-log-analytics"
target_resource_id = azurerm_public_ip.appgw_publicIP.id
log_analytics_workspace_id = var.log_analytics_workspace_id
resource "azurerm_monitor_diagnostic_setting" "kv_log_analytics" {
count = var.enable_kv_logs_to_log_analytics ? 1 : 0
name = "loganalytics-diagnostics"
target_resource_id = data.terraform_remote_state.keyvault.outputs.key_vault_id
log_analytics_workspace_id = data.terraform_remote_state.loganalytics.outputs.law_id
resource "azurerm_monitor_diagnostic_setting" "virtual_network_diagnostic_setting" {
name = "setByPolicy"
target_resource_id = var.shared_service_virtual_network.id
storage_account_id = var.shared_service_diag_storage.id
log_analytics_workspace_id = var.shared_service_diag_log_analytics.id
resource "azurerm_monitor_diagnostic_setting" "avd-pool-diags" {
name = "adds-diags"
target_resource_id = azurerm_virtual_desktop_host_pool.avd-pool.id
log_analytics_workspace_id = azurerm_log_analytics_workspace.avd-workspace.id
log {
resource "azurerm_monitor_diagnostic_setting" "settings" {
name = "DiagnosticsSettings"
target_resource_id = var.aks_cluster_id
log_analytics_workspace_id = var.log_analytics_workspace_id
log {
Parameters
-
eventhub_authorization_rule_id
optional - string -
eventhub_name
optional - string -
id
optional computed - string -
log_analytics_destination_type
optional - string -
log_analytics_workspace_id
optional - string -
name
required - string -
storage_account_id
optional - string -
target_resource_id
required - string -
log
set block-
category
required - string -
enabled
optional - bool -
retention_policy
list block
-
-
metric
set block-
category
required - string -
enabled
optional - bool -
retention_policy
list block
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a Diagnostic Setting for an existing Resource.
Tips: Best Practices for The Other Azure Monitor Resources
In addition to the azurerm_monitor_log_profile, Azure Monitor has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_monitor_log_profile
Ensure to enable the activity retention log
It is better to enable the activity retention log to ensure that all the information required for an effective investigation is still available.
Microsoft.KeyVault/vaults (Azure Resource Manager)
The vaults in Microsoft.KeyVault can be configured in Azure Resource Manager with the resource name Microsoft.KeyVault/vaults
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2021-04-01-preview",
"name": "[parameters('KeyVaultNameStoringAppSecret')]",
"location": "[parameters('LocationNameOfKeyVaultStoringAppSecret')]",
"properties": {
"tenantId": "[subscription().tenantId]",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2021-04-01-preview",
"name": "[parameters('KeyVaultNameStoringAppSecret')]",
"location": "[parameters('LocationNameOfKeyVaultStoringAppSecret')]",
"properties": {
"tenantId": "[subscription().tenantId]",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
Parameters
apiVersion
required - stringlocation
required - stringThe supported Azure location where the key vault should be created.
name
required - stringName of the vault
properties
requiredaccessPolicies
optional arrayapplicationId
optional - stringApplication ID of the client making request on behalf of a principal
objectId
required - stringThe object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
permissions
requiredcertificates
optional - arrayPermissions to certificates
keys
optional - arrayPermissions to keys
secrets
optional - arrayPermissions to secrets
storage
optional - arrayPermissions to storage accounts
tenantId
required - stringThe Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
createMode
optional - stringThe vault's create mode to indicate whether the vault need to be recovered or not.
enabledForDeployment
optional - booleanProperty to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
enabledForDiskEncryption
optional - booleanProperty to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
enabledForTemplateDeployment
optional - booleanProperty to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
enablePurgeProtection
optional - booleanProperty specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
enableRbacAuthorization
optional - booleanProperty that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
enableSoftDelete
optional - booleanProperty to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
networkAcls
optionalbypass
optional - stringTells what traffic can bypass network rules. This can be 'AzureServices' or 'None'. If not specified the default is 'AzureServices'.
defaultAction
optional - stringThe default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
ipRules
optional arrayvalue
required - stringAn IPv4 address range in CIDR notation, such as '124.56.78.91' (simple IP address) or '124.56.78.0/24' (all addresses that start with 124.56.78).
virtualNetworkRules
optional arrayid
required - stringFull resource id of a vnet subnet, such as '/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1'.
ignoreMissingVnetServiceEndpoint
optional - booleanProperty to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
provisioningState
optional - stringProvisioning state of the vault.
sku
requiredfamily
required - stringSKU family name
name
required - stringSKU name to specify whether the key vault is a standard vault or a premium vault.
softDeleteRetentionInDays
optional - integersoftDelete data retention days. It accepts >=7 and <=90.
tenantId
required - stringThe Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
vaultUri
optional - stringThe URI of the vault for performing operations on keys and secrets. This property is readonly
tags
optional - stringThe tags that will be assigned to the key vault.
type
required - string
Frequently asked questions
What is Azure Monitor Diagnostic Setting?
Azure Monitor Diagnostic Setting is a resource for Monitor of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Monitor Diagnostic Setting?
For Terraform, the briandenicola/cqrs, carlessanagustin/kubernetes_on_azure and michaelburch/azure-terraform source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the OTRF/Microsoft-Sentinel2Go, seanstark/Sentinel and VJchand-star/Azure source code examples are useful. See the Azure Resource Manager Example section for further details.