log activities from subscriptions used in an MLZ deployment into the Operations log analytics workspace

src/bicep/mlz.bicep

@@ -253,16 +253,13 @@ module sharedServicesVirtualNetworkPeering './modules/spokeNetworkPeering.bicep'
 }
 
 module hubPolicyAssignment './modules/policyAssignment.bicep' = {
-  name: '${hubResourceGroupName}-policyAssignement'
+  name: '${hubResourceGroupName}-policyAssignment'
   scope: resourceGroup(hubSubscriptionId, hubResourceGroupName)
-  dependsOn: [
-    hubResourceGroup
-    logAnalyticsWorkspace
-  ]
   params: {
     builtInAssignment: policy
     logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
     logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+    operationsSubscriptionId: operationsSubscriptionId
   }
 }
 
@@ -273,34 +270,65 @@ module operationsPolicyAssignment './modules/policyAssignment.bicep' = {
     builtInAssignment: policy
     logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
     logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+    operationsSubscriptionId: operationsSubscriptionId
   }
 }
 
 module sharedServicesPolicyAssignment './modules/policyAssignment.bicep' = {
   name: '${sharedServicesResourceGroupName}-policyAssignement'
   scope: resourceGroup(sharedServicesSubscriptionId, sharedServicesResourceGroupName)
-  dependsOn: [
-    sharedServicesResourceGroup
-    logAnalyticsWorkspace
-  ]
   params: {
     builtInAssignment: policy
     logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
     logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+    operationsSubscriptionId: operationsSubscriptionId
   }
 }
 
 module identityPolicyAssignment './modules/policyAssignment.bicep' = {
   name: '${identityResourceGroupName}-policyAssignement'
   scope: resourceGroup(identitySubscriptionId, identityResourceGroupName)
-  dependsOn: [
-    identityResourceGroup
-    logAnalyticsWorkspace
-  ]
   params: {
     builtInAssignment: policy
     logAnalyticsWorkspaceName: logAnalyticsWorkspace.outputs.name
     logAnalyticsWorkspaceResourceGroupName: operationsResourceGroup.outputs.name
+    operationsSubscriptionId: operationsSubscriptionId
+  }
+}
+
+module hubSubscriptionCreateActivityLogging './modules/centralLogging.bicep' = {
+  name: 'deploy-hub-sub-activity-logging'
+  scope: subscription(hubSubscriptionId)
+  params: {
+    diagnosticSettingName: 'log-hub-sub-activity-to-${logAnalyticsWorkspace.outputs.name}'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.id
+  }
+}
+
+module operationsSubscriptionCreateActivityLogging './modules/centralLogging.bicep' = if(hubSubscriptionId != operationsSubscriptionId) {
+  name: 'deploy-operations-sub-activity-logging'
+  scope: subscription(operationsSubscriptionId)
+  params: {
+    diagnosticSettingName: 'log-operations-sub-activity-to-${logAnalyticsWorkspace.outputs.name}'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.id
+  }
+}
+
+module identitySubscriptionCreateActivityLogging './modules/centralLogging.bicep' = if(hubSubscriptionId != identitySubscriptionId) {
+  name: 'deploy-identity-sub-activity-logging'
+  scope: subscription(identitySubscriptionId)
+  params: {
+    diagnosticSettingName: 'log-identity-sub-activity-to-${logAnalyticsWorkspace.outputs.name}'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.id
+  }
+}
+
+module sharedServicesSubscriptionCreateActivityLogging './modules/centralLogging.bicep' = if(hubSubscriptionId != sharedServicesSubscriptionId) {
+  name: 'deploy-sharedServices-sub-activity-logging'
+  scope: subscription(sharedServicesSubscriptionId)
+  params: {
+    diagnosticSettingName: 'log-sharedServices-sub-activity-to-${logAnalyticsWorkspace.outputs.name}'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspace.outputs.id
   }
 }
 

src/bicep/modules/centralLogging.bicep

@@ -0,0 +1,48 @@
+// scope
+targetScope = 'subscription'
+
+param diagnosticSettingName string
+param logAnalyticsWorkspaceId string
+
+//// Central activity logging to LAWS
+resource centralLoggingDiagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
+  name: diagnosticSettingName
+  properties: {
+    workspaceId: logAnalyticsWorkspaceId
+    logs: [
+      {
+        category: 'Administrative'
+        enabled: true
+      }
+      {
+        category: 'Security'
+        enabled: true
+      }
+      {
+        category: 'ServiceHealth'
+        enabled: true
+      }
+      {
+        category: 'Alert'
+        enabled: true
+      }
+      {
+        category: 'Recommendation'
+        enabled: true
+      }
+      {
+        category: 'Policy'
+        enabled: true
+      }
+      {
+        category: 'Autoscale'
+        enabled: true
+      }
+      {
+        category: 'ResourceHealth'
+        enabled: true
+      }
+    ]
+  }
+
+}

src/bicep/modules/policyAssignment.bicep

@@ -1,11 +1,12 @@
 param builtInAssignment string = ''
 param logAnalyticsWorkspaceName string
 param logAnalyticsWorkspaceResourceGroupName string
+param operationsSubscriptionId string
 
 // Creating a symbolic name for an existing resource
 resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2021-06-01' existing = {
   name: logAnalyticsWorkspaceName
-  scope: resourceGroup(logAnalyticsWorkspaceResourceGroupName)
+  scope: resourceGroup(operationsSubscriptionId, logAnalyticsWorkspaceResourceGroupName)
 }
 
 var policyDefinitionID = {