davidkarlsen
commented
1 year ago For reference this is what I ended up with when "doing it myself":
// https://github.com/Azure/bicep-registry-modules/issues/2434
resource sqlServerAudit 'Microsoft.Sql/servers/auditingSettings@2022-05-01-preview' = {
name: '${sqlServer.name}/auditSettings'
properties: {
auditActionsAndGroups:[
'BATCH_COMPLETED_GROUP'
'SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP'
'FAILED_DATABASE_AUTHENTICATION_GROUP'
]
isAzureMonitorTargetEnabled: true
isDevopsAuditEnabled: true
state: 'Enabled'
}
}
resource databaseAudit 'Microsoft.Sql/servers/databases/auditingSettings@2022-05-01-preview' = {
name: 'default'
parent: database[1]
properties: {
auditActionsAndGroups:[
'BATCH_COMPLETED_GROUP'
'SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP'
'FAILED_DATABASE_AUTHENTICATION_GROUP'
]
isAzureMonitorTargetEnabled: true
retentionDays: diagnosticLogsRetentionInDays
state: 'Enabled'
}
}
var databases = ['master', databaseName]
resource database 'Microsoft.Sql/servers/databases@2021-11-01-preview' existing = [for database in databases: {
name: '${sqlServer.name}/${database}'
}]
// https://github.com/Azure/bicep-registry-modules/issues/2434
// https://github.com/Azure/bicep/discussions/8386
resource sqlServerLogAnalyticsMasterDatabase 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [for i in range(0, length(databases)): {
scope: database[i]
name: 'auditSettings'
properties: {
workspaceId: logAnalyticsWorkspace.id
logs: [for category in ['SQLSecurityAuditEvents' /*, 'DevOpsOperationsAudit'*/]: {
category: category
enabled: true
retentionPolicy: {
days: diagnosticLogsRetentionInDays
enabled: true
}
}]
}
dependsOn: [
sqlServer
]
}]
microsoft-github-policy-service[bot]
AlexanderSehr
Description
It would be nice (and natural) if the module https://github.com/Azure/ResourceModules/tree/main/modules/Microsoft.Sql/servers supported defining the audit-settings: https://learn.microsoft.com/en-us/azure/templates/microsoft.sql/servers/auditingsettings?pivots=deployment-language-bicep