I am working in an existing Azure environment where there is no governance and I am in the process of creating Azure Policies. Currently I am working on creating Azure Policy to enable Diagnostic settings for Azure Web App, Azure Function App and Web API. Initially I had one Azure Policy for all type of Web Apps. Later I split into two.
- Web App & Web API
- Function App
I thought to address the Function App with the below Policy Rule. But no resources where remediated.
We have about 60+ web apps without any governance and now when I want to implement Diagnostic settings to most of the azure services I find it difficult to debug why the azure policies are not remediated. Because when you remediate a policy it tries to perform the DeployIfNotExists action for azure web apps which is not an efficient way. How do we validate the policy rule conditions from a Cloud engineer point of view? Use Kusto Queries or Powershell/Azure CLI on the policyrule.
I tried with the built-in policy for function app (Enable logging by category group for Function App (microsoft.web/sites) to Log Analytics) but it didnt work as well.
"if": {
"allOf": [
{
"field": "type",
"equals": "Microsoft.Web/sites"
},
{
"not": {
"anyof": [
{
"field": "kind",
"like": "app"
},
{
"field": "kind",
"like": "api"
},
{
"field": "kind",
"like": "app,linux"
},
{
"field": "kind",
"like": "app,windows"
}
]
}
},
{
"field": "kind",
"like": "functionapp"
},
{
"field": "kind",
"like": "functionapp,linux"
}
]
},
"then": {
"effect": "[parameters('effect')]",
"details": {
"type": "Microsoft.Insights/diagnosticSettings",
"name": "[parameters('profileName')]",
"existenceCondition": {
"allOf": [
{
"field": "Microsoft.Insights/diagnosticSettings/workspaceId",
"equals": "[parameters('logAnalytics')]"
}
]
},
"roleDefinitionIds": [
],
"deployment": {
"properties": {
"mode": "incremental",
"template": {
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"resourceName": {
"type": "string"
},
"logAnalytics": {
"type": "string"
},
"location": {
"type": "string"
},
"profileName": {
"type": "string"
},
"functionAppLogs": {
"type": "string"
},
"appServiceAuthenticationLogs": {
"type": "string"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Web/sites/providers/diagnosticSettings",
"apiVersion": "2017-05-01-preview",
"name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('profileName'))]",
"location": "[parameters('location')]",
"dependsOn": [],
"properties": {
"workspaceId": "[parameters('logAnalytics')]",
"logs": [
{
"category": "FunctionAppLogs",
"enabled": "[parameters('functionAppLogs')]"
},
{
"category": "AppServiceAuthenticationLogs",
"enabled": "[parameters('appServiceAuthenticationLogs')]"
}
]
}
}
],
"outputs": {}
},
"parameters": {
"logAnalytics": {
"value": "[parameters('logAnalytics')]"
},
"resourceName": {
"value": "[field('name')]"
},
"location": {
"value": "[field('location')]"
},
"profileName": {
"value": "[parameters('profileName')]"
},
"functionAppLogs": {
"value": "[parameters('functionAppLogs')]"
},
"appServiceAuthenticationLogs": {
"value": "[parameters('appServiceAuthenticationLogs')]"
}
}
}
}
}
}
}
}```