[AVM Module Issue]: management-group has no option for diagnostic logs

awood86 commented 3 weeks ago

Check for previous/existing GitHub issues

[X] I have checked for previous/existing GitHub issues

Issue Type?

Feature Request

Module Name

avm/res/management/management-group

(Optional) Module Version

0.1.2

Description

Would you be able to add Diagnostics onto this module. A bit like below:

targetScope = 'managementGroup'

param parDiagnosticSettingsName string = 'toLa'

param parLogAnalyticsWorkspaceResourceId string

resource resMgDiagSet 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: parDiagnosticSettingsName
  properties: {
    workspaceId: parLogAnalyticsWorkspaceResourceId
    logs: [
      {
        category: 'Administrative'
        enabled: true
      }
      {
        category: 'Policy'
        enabled: true
      }
    ]
  }
}

(Optional) Correlation Id

No response

microsoft-github-policy-service[bot] commented 3 weeks ago

[!IMPORTANT] The "Needs: Triage :mag:" label must be removed once the triage process is complete!

[!TIP] For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

avm-team-linter[bot] commented 3 weeks ago

@awood86, thanks for submitting this issue for the avm/res/management/management-group module!

[!IMPORTANT] A member of the @Azure/avm-res-management-managementgroup-module-owners-bicep or @Azure/avm-res-management-managementgroup-module-contributors-bicep team will review it soon!

fblix commented 3 weeks ago

Since I am currently quite busy, I would appreciate any help on this topic!

microsoft-github-policy-service[bot] commented 3 weeks ago

[!WARNING] Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

[!TIP]

To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.

To avoid this rule being (re)triggered, the ""Needs: Triage :mag:" label must be removed as part of the triage process (when the issue is first responded to)!

AlexanderSehr commented 3 weeks ago

I'll be damned. It seems like there is an API even though I cannot seem to find it in the Portal. In any case, that means nothing should speak against implementing it. The only challenge I see is that it's a bit difficult to identify which metrics/logs can be configurated.

microsoft-github-policy-service[bot] commented 2 weeks ago

[!WARNING] Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

[!TIP]

To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.

To avoid this rule being (re)triggered, the ""Needs: Triage :mag:" label must be removed as part of the triage process (when the issue is first responded to)!

microsoft-github-policy-service[bot] commented 2 weeks ago

[!CAUTION] This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days.

[!TIP]

To avoid this rule being (re)triggered, the "Needs: Triage :mag:" and "Status: Response Overdue :triangular_flag_on_post:" labels must be removed when the issue is first responded to!

Remove the "Needs: Immediate Attention :bangbang:" label once the issue has been responded to.

awood86 commented 2 weeks ago

I'll be damned. It seems like there is an API even though I cannot seem to find it in the Portal. In any case, that means nothing should speak against implementing it. The only challenge I see is that it's a bit difficult to identify which metrics/logs can be configurated.

Yeah it doesn't show in the portal for some reason. I picked up the diagnostic logs for the Management Groups from the ALZ Bicep modules as they provide this functionality

Just one to add to the module notes:

Notes Considerations This template is using a Tenant level deployment, meaning the user/principal deploying it needs to have the proper access

If owner access is excessive, the following rights roles will grant enough rights:

Automation Job Operator at tenant level (scope '/') Management Group Contributor at the top management group that needs to be managed Consider using the following script:

$PrincipalID = "<The object ID of the identity here>"
$TopMGID = "<The group ID of the management group here>"
New-AzRoleAssignment -ObjectId $PrincipalID -Scope "/" -RoleDefinitionName "Automation Job Operator"
New-AzRoleAssignment -ObjectId $PrincipalID -Scope "/providers/Microsoft.Management/managementGroups/$TopMGID" -RoleDefinitionName "Management Group Contributor"

The user/principal will also need something like Monitoring Contributor to the Management Group and will also need something like Log Analytics Contributor to the workspace (If they are deploying to the Log Analytics workspace)

microsoft-github-policy-service[bot] commented 1 week ago

[!WARNING] Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

[!TIP]

To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.

To avoid this rule being (re)triggered, the ""Needs: Triage :mag:" label must be removed as part of the triage process (when the issue is first responded to)!

microsoft-github-policy-service[bot] commented 1 week ago

[!CAUTION] This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days.

[!TIP]

To avoid this rule being (re)triggered, the "Needs: Triage :mag:" and "Status: Response Overdue :triangular_flag_on_post:" labels must be removed when the issue is first responded to!

Remove the "Needs: Immediate Attention :bangbang:" label once the issue has been responded to.

microsoft-github-policy-service[bot] commented 6 days ago

[!WARNING] Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

[!TIP]

To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.

To avoid this rule being (re)triggered, the ""Needs: Triage :mag:" label must be removed as part of the triage process (when the issue is first responded to)!

microsoft-github-policy-service[bot] commented 6 days ago

[!CAUTION] This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days.

[!TIP]

To avoid this rule being (re)triggered, the "Needs: Triage :mag:" and "Status: Response Overdue :triangular_flag_on_post:" labels must be removed when the issue is first responded to!

Remove the "Needs: Immediate Attention :bangbang:" label once the issue has been responded to.

microsoft-github-policy-service[bot] commented 1 day ago

[!WARNING] Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

[!TIP]

To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.

To avoid this rule being (re)triggered, the ""Needs: Triage :mag:" label must be removed as part of the triage process (when the issue is first responded to)!

microsoft-github-policy-service[bot] commented 1 day ago

[!CAUTION] This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days.

[!TIP]

To avoid this rule being (re)triggered, the "Needs: Triage :mag:" and "Status: Response Overdue :triangular_flag_on_post:" labels must be removed when the issue is first responded to!

Remove the "Needs: Immediate Attention :bangbang:" label once the issue has been responded to.

Azure / bicep-registry-modules