deploy_firewall_diagnostic_setting.json

{
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "deploy_firewall_diagnostic_setting",
  "properties": {
    "displayName": "Deploy Diagnostic Settings for Firewalls to a Log Analytics workspace",
    "description": "Deploys the diagnostic settings for Firewalls to stream to a regional Log Analytics workspace when any Firewall which is missing this diagnostic settings is created or updated.",
    "metadata": {
      "category": "Monitoring"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "defaultValue": "DeployIfNotExists",
        "allowedValues": [
          "AuditIfNotExists",
          "DeployIfNotExists",
          "Disabled"
        ],
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        }
      },
      "profileName": {
        "type": "String",
        "defaultValue": "setbypolicy_Diagnostics",
        "metadata": {
          "displayName": "Profile name",
          "description": "The diagnostic settings profile name"
        }
      },
      "workspaceId": {
        "type": "String",
        "metadata": {
          "displayName": "Log Analytics workspace Id",
          "description": "Select Log Analytics workspace from dropdown list. If this workspace is outside of the scope of the assignment you must manually grant 'Log Analytics Contributor' permissions (or similar) to the policy assignment's principal ID.",
          "assignPermissions": true
        }
      },
      "storageAccountId": {
        "type": "String",
        "metadata": {
          "displayName": "Storage Account Id",
          "description": "The Storage Account Resource Id to send activity logs",
          "assignPermissions": true
        }
      },
      "eventHubAuthorizationRuleId": {
        "type": "String",
        "metadata": {
          "displayName": "Event Hub Authorization Rule Id",
          "description": "The Event Hub authorization rule Id for Azure Diagnostics. The authorization rule needs to be at Event Hub namespace level. e.g. /subscriptions/{subscription Id}/resourceGroups/{resource group}/providers/Microsoft.EventHub/namespaces/{Event Hub namespace}/authorizationrules/{authorization rule}",
          "assignPermissions": true
        }
      },
      "eventHubName": {
        "type": "String",
        "metadata": {
          "displayName": "EventHub name",
          "description": "The EventHub name to stream activity logs to",
          "assignPermissions": true
        }
      },
      "metricsEnabled": {
        "type": "String",
        "defaultValue": "False",
        "allowedValues": [
          "True",
          "False"
        ],
        "metadata": {
          "displayName": "Enable metrics",
          "description": "Whether to enable metrics stream to the Log Analytics workspace - True or False"
        }
      },
      "logsEnabled": {
        "type": "String",
        "defaultValue": "True",
        "allowedValues": [
          "True",
          "False"
        ],
        "metadata": {
          "displayName": "Enable logs",
          "description": "Whether to enable logs stream to the Log Analytics workspace - True or False"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.Network/azureFirewalls"
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
          ],
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
                "equals": "True"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
                "equals": "True"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/eventHubName",
                "matchInsensitively": "[parameters('eventHubName')]"
              }
            ]
          },
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "resourceName": {
                    "type": "String"
                  },
                  "workspaceId": {
                    "type": "String"
                  },
                  "storageAccountId": {
                    "type": "String"
                  },
                  "eventHubAuthorizationRuleId": {
                    "type": "String"
                  },
                  "eventHubName": {
                    "type": "String"
                  },
                  "metricsEnabled": {
                    "type": "String"
                  },
                  "logsEnabled": {
                    "type": "String"
                  },
                  "profileName": {
                    "type": "String"
                  }
                },
                "variables": {},
                "resources": [
                  {
                    "type": "Microsoft.Network/azureFirewalls/providers/diagnosticSettings",
                    "apiVersion": "2017-05-01-preview",
                    "name": "[concat(parameters('resourceName'), '/', 'Microsoft.Insights/', parameters('profileName'))]",
                    "location": "uksouth",
                    "dependsOn": [],
                    "properties": {
                      "workspaceId": "[parameters('workspaceId')]",
                      "storageAccountId": "[parameters('storageAccountId')]",
                      "eventHubAuthorizationRuleId": "[parameters('eventHubAuthorizationRuleId')]",
                      "eventHubName": "[parameters('eventHubName')]",
                      "metrics": [
                        {
                          "category": "AllMetrics",
                          "enabled": "[parameters('metricsEnabled')]",
                          "timeGrain": null
                        }
                      ],
                      "logs": [
                        {
                          "category": "AzureFirewallApplicationRule",
                          "enabled": "[parameters('logsEnabled')]"
                        },
                        {
                          "category": "AzureFirewallNetworkRule",
                          "enabled": "[parameters('logsEnabled')]"
                        },
                        {
                          "category": "AzureFirewallDnsProxy",
                          "enabled": "[parameters('logsEnabled')]"
                        }
                      ]
                    }
                  }
                ],
                "outputs": {}
              },
              "parameters": {
                "resourceName": {
                  "value": "[field('name')]"
                },
                "workspaceId": {
                  "value": "[parameters('workspaceId')]"
                },
                "storageAccountId": {
                  "Value": "[parameters('storageAccountId')]"
                },
                "eventHubAuthorizationRuleId": {
                  "Value": "[parameters('eventHubAuthorizationRuleId')]"
                },
                "eventHubName": {
                  "Value": "[parameters('eventHubName')]"
                },
                "metricsEnabled": {
                  "value": "[parameters('metricsEnabled')]"
                },
                "logsEnabled": {
                  "value": "[parameters('logsEnabled')]"
                },
                "profileName": {
                  "value": "[parameters('profileName')]"
                }
              }
            }
          }
        }
      }
    }
  }
}