deploy_network_interface_diagnostic_setting.json

{
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "deploy_network_interface_diagnostic_setting",
  "properties": {
    "displayName": "Deploy Diagnostic Settings for Network Interfaces to a Log Analytics workspace",
    "description": "Deploys the diagnostic settings for Network Interfaces to stream to a regional Log Analytics workspace when any Network Interface which is missing this diagnostic settings is created or updated.",
    "metadata": {
      "category": "Monitoring"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "defaultValue": "DeployIfNotExists",
        "allowedValues": [
          "AuditIfNotExists",
          "DeployIfNotExists",
          "Disabled"
        ],
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        }
      },
      "profileName": {
        "type": "String",
        "defaultValue": "setbypolicy_Diagnostics",
        "metadata": {
          "displayName": "Profile name",
          "description": "The diagnostic settings profile name"
        }
      },
      "workspaceId": {
        "type": "String",
        "metadata": {
          "displayName": "Log Analytics workspace Id",
          "description": "Select Log Analytics workspace from dropdown list. If this workspace is outside of the scope of the assignment you must manually grant 'Log Analytics Contributor' permissions (or similar) to the policy assignment's principal ID.",
          "assignPermissions": true
        }
      },
      "storageAccountId": {
        "type": "String",
        "metadata": {
          "displayName": "Storage Account Id",
          "description": "The Storage Account Resource Id to send activity logs",
          "assignPermissions": true
        }
      },
      "eventHubAuthorizationRuleId": {
        "type": "String",
        "metadata": {
          "displayName": "Event Hub Authorization Rule Id",
          "description": "The Event Hub authorization rule Id for Azure Diagnostics. The authorization rule needs to be at Event Hub namespace level. e.g. /subscriptions/{subscription Id}/resourceGroups/{resource group}/providers/Microsoft.EventHub/namespaces/{Event Hub namespace}/authorizationrules/{authorization rule}",
          "assignPermissions": true
        }
      },
      "eventHubName": {
        "type": "String",
        "metadata": {
          "displayName": "EventHub name",
          "description": "The EventHub name to stream activity logs to",
          "assignPermissions": true
        }
      },
      "metricsEnabled": {
        "type": "String",
        "metadata": {
          "displayName": "Enable Metrics",
          "description": "Enable Metrics - True or False"
        },
        "allowedValues": [
          "True",
          "False"
        ],
        "defaultValue": "True"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/networkInterfaces"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "name": "[parameters('profileName')]",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
                "equals": "[parameters('metricsEnabled')]"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/eventHubName",
                "matchInsensitively": "[parameters('eventHubName')]"
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "resourceName": {
                    "type": "String"
                  },
                  "workspaceId": {
                    "type": "String"
                  },
                  "storageAccountId": {
                    "type": "String"
                  },
                  "eventHubAuthorizationRuleId": {
                    "type": "String"
                  },
                  "eventHubName": {
                    "type": "String"
                  },
                  "metricsEnabled": {
                    "type": "String"
                  },
                  "profileName": {
                    "type": "String"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.Network/networkInterfaces/providers/diagnosticSettings",
                    "apiVersion": "2017-05-01-preview",
                    "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('profileName'))]",
                    "location": "uksouth",
                    "dependsOn": [],
                    "properties": {
                      "workspaceId": "[parameters('workspaceId')]",
                      "storageAccountId": "[parameters('storageAccountId')]",
                      "eventHubAuthorizationRuleId": "[parameters('eventHubAuthorizationRuleId')]",
                      "eventHubName": "[parameters('eventHubName')]",
                      "metrics": [
                        {
                          "category": "AllMetrics",
                          "enabled": "[parameters('metricsEnabled')]",
                          "timeGrain": null
                        }
                      ]
                    }
                  }
                ],
                "outputs": {
                  "policy": {
                    "type": "String",
                    "value": "[concat(parameters('eventHubName'), 'configured for diagnostic logs for ', ': ', parameters('resourceName'))]"
                  }
                }
              },
              "parameters": {
                "resourceName": {
                  "value": "[field('name')]"
                },
                "workspaceId": {
                  "value": "[parameters('workspaceId')]"
                },
                "storageAccountId": {
                  "Value": "[parameters('storageAccountId')]"
                },
                "eventHubAuthorizationRuleId": {
                  "Value": "[parameters('eventHubAuthorizationRuleId')]"
                },
                "eventHubName": {
                  "Value": "[parameters('eventHubName')]"
                },
                "metricsEnabled": {
                  "value": "[parameters('metricsEnabled')]"
                },
                "profileName": {
                  "value": "[parameters('profileName')]"
                }
              }
            }
          }
        }
      }
    }
  }
}