Azure / Azure/Azure-Landing-Zones

Diagnostic profiles regression when moving from v5 to v6

Open
#233 1 comment 4 reactions 0 assignees View on GitHub
Transfer From: Enterprise-Scale :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Versions

**terraform**: 1.9.5

**azure provider**: 3.107.0

**module**: 6.1.0

### Description

Until version 5.x it was possible to create diagnostic profiles with Metrics and for some resource like Firewall and API Management to store the logs into dedicated tables.

Following the upgrade to version 6 which is transitioning to the built-in policies those features are not available anymore and are not documented into the upgrade wiki breaking change section <[link](https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/wiki/%5BUser-Guide%5D-Upgrade-from-v5.2.1-to-v6.0.0)>.

#### Describe the bug

In Versions <= 5 the policy assignment **Deploy-Resource-Diag** was used. Example of the policy parameters
```yaml
Deploy-Resource-Diag:
logAnalytics: ${log_analytics_workspace_resource_id}
APIMgmtLogAnalyticsDestinationType: Dedicated
FirewallLogAnalyticsDestinationType: Dedicated
profileName: setbypolicy
```

From V6 **Deploy-Resource-Diag** has been replaced by **Deploy-Diag-Logs** >> [link](https://github.com/Azure/azure-policy/blob/50fb8cf4c71dc97530398c71094ca9ff98930e30/built-in-policies/policySetDefinitions/Monitoring/AzureMonitor_DiagSettings_logAnalytics_allLogs.json)

Three Bugs in Deploy-Diag-Logs:

1. Does not support Metrics
2. Does not support Destination tabled like Dedicated
3. Upgrade note does not explain how to change from **Deploy-Resource-Diag** to **Deploy-Diag-Logs**

I understand the motivation to move to native policies but it should only been done if it is at feature parity.

#### Steps to Reproduce

1. Deploy ALZ module version 5 with the above settings and a firewall in secure hub
2. Trigger the policy remediation to get the diagnostic profiles created
3. Upgrade to v6.1.0
4. trigger a policy remediation

#### Screenshots

#### Additional context

[](https://github.com/Azure/azure-policy/blob/50fb8cf4c71dc97530398c71094ca9ff98930e30/built-in-policies/policySetDefinitions/Monitoring/AzureMonitor_DiagSettings_logAnalytics_allLogs.json)
https://github.com/Azure/azure-policy/blob/50fb8cf4c71dc97530398c71094ca9ff98930e30/built-in-policies/policyDefinitions/Monitoring/DS_LA_network-azurefirewalls_DINE.json

Contributor guide

Open the contributing guide

Research direction

Start with the v5-to-v6 upgrade wiki and compare the Deploy-Resource-Diag parameters with Deploy-Diag-Logs. Read the linked Azure policy files, including AzureMonitor_DiagSettings_logAnalytics_allLogs.json and DS_LA_network-azurefirewalls_DINE.json, then reproduce the remediation steps with module 5 and 6. Done means the reported metrics and dedicated-table behavior is restored or the upgrade documentation clearly explains the supported migration.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, terraform
Domain
cloud, documentation
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.