Multiple assignment of a single policy

[dpb519]

Hi Gettek,

We have a log analytics diagnostic setting related policy for one of the resources. We have to assign this policy to each subscription with resource id of the log analytics workspace specific to that subscription. We have 30+ subscriptions and its going to increase in future. Instead of adding a new assignment specific to each subscription, I am looking for a way to do this dynamically? is this currently possible? any examples?

[gettek]

Hi @dpb519, have you considered the use of Management Groups? This will enable inheritance to all child Subscriptions, Resource Groups and Resources. Have a look at definition-and-assignment-scopes on the main ReadMe.

The examples folder also contains a diagnostics initiative assignment which you may refer to.

Hope this helps.

[dpb519]

yes we did consider it. However, in our scenario, each subscription has its own log analytics workspace. we need to apply the policy on the subscription configuring log analytics specific to that subscription.

[gettek]

Presuming you have a standardised naming convention (or even if not) it should be fairly straightforward to use ARM functions to dynamically pick up each subscriptions respective workspaceId.

I believe you can still have a single Management Group scope assignment if the deployment template contains the appropriate functions. Test initially by assigning at Sub scope then at MG.

If you have a strict requirement to assign the policy on each subscription, then you can be more explicit with your assignment_parameters by specifying key/value maps; { sub_id = workspaceId }

[dpb519]

"I believe you can still have a single Management Group scope assignment if the deployment template contains the appropriate functions. Test initially by assigning at Sub scope then at MG."
If this can be achieved, then i am fine with it. Can you please elaborate on this? any reference? Example?

[gettek]

I've not tested this but give the below snippet a try to obtain the workspaceId using the resourceId ARM function:

Assuming all workspace names and respective resource group names are the same:

{
    "resources": [
        {
            "type": "Microsoft.Compute/virtualMachines/providers/diagnosticSettings",
            "apiVersion": "2017-05-01-preview",
            "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('profileName'))]",
            "dependsOn": [],
            "properties": {
                "workspaceId": "[resourceId(parameters('workspaceResourceGroup'), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]",
                "metrics": [
                    {
                        "category": "AllMetrics",
                        "enabled": "[parameters('metricsEnabled')]",
                        "timeGrain": null
                    }
                ],
                "logs": [
                    {
                        "category": "AllLogs",
                        "enabled": "[parameters('logsEnabled')]"
                    }
                ]
            }
        }
    ]
}

If you have some special naming convention you might be able to replicate this within the deployment variables {} block, and use those in favour of parameters.

[dpb519]

thanks. however i was able able to achieve the same in the below way.
Key value pair

# "SubscriptionID" = "LogAnalyticsWorkspace-resourceid"
locals {
  all_subscriptions = {
    "xxxxx-8xx-4xxx-xxx6-xxxxa5xx" = "/subscriptions/xxxxx-8xx-4xxx-xxx6-xxxxa5xx/resourceGroups/rg-loganalytic01/providers/Microsoft.OperationalInsights/workspaces/law-01",
    "xxxxx-7xx-6xxx-xxx6-xxxxa6xx" = "/subscriptions/xxxxx-8xx-4xxx-xxx6-xxxxa5xx/resourceGroups/rg-loganalytic01/providers/Microsoft.OperationalInsights/workspaces/law-02",
     }
}


module "rg_diag_policies" {  

for_each = local.all_subscriptions

  source            = "../modules/def_assignment"
    definition        = module.appgateway_policies["<<PolicyDefinitionName>>"].definition
    assignment_scope =  "/subscriptions/${each.key}"
    assignment_name = "ag_diagSetting"
    assignment_display_name = "assign diagSetting"
  assignment_parameters = {
    diagSettingLawEffect="DeployIfNotExists"
    metricsEnabled = "False"
    logsEnabled = "True"
    logAnalytics = each.value
  }
}