AzPolicyAdvertizer

last sync: 2025-Jul-28 17:33:33 UTC

Deploy Diagnostic Settings for Azure SQL Database to Event Hub

Azure BuiltIn Policy definition

-Source
+ Azure Portal
-Display name
+Deploy Diagnostic Settings for Azure SQL Database to Event Hub
-Id
+a7c7a7d-49e5-4213-bea8-6a502b6272e0
-Version
+.2.0
  Details on versioning
-Versioning
+                        Versions supported for Versioning: 1
1.2.0
                         Built-in Versioning [Preview]
-Category
+SQL
 Microsoft Learn
-Description
+Deploys the diagnostic settings for Azure SQL Database to stream to a regional Event Hub on any Azure SQL Database which is missing this diagnostic settings is created or updated.
-Cloud environments
+AzureCloud = true
AzureUSGovernment = unknown
AzureChinaCloud = unknown
-Available in AzUSGov
+Unknown, no evidence if Policy definition is/not available in AzureUSGovernment
-Mode
+Indexed
-Type
+BuiltIn
-Preview
+                False
-Deprecated
+False
-Effect
+                    Fixed
DeployIfNotExists
-RBAC role(s)
+                                Role Name
                                Role Id
                            
                                                        
                                    Contributor
                                    b24988ac-6180-42a0-ab88-20f7382dd24c
-Role Name
+Role Id
-Contributor
+b24988ac-6180-42a0-ab88-20f7382dd24c
-Rule aliases
+                    THEN-ExistenceCondition (2)

                    
                                        
                        Alias
                        Namespace
                        ResourceType
                        Path
                        PathIsDefault
                        DefaultPath
                        Modifiable
                    
                                                
                                Microsoft.Insights/diagnosticSettings/logs[*].enabled
                                microsoft.insights
                                diagnosticSettings
                                properties.logs[*].enabled
                                True
                                
                                False
                            
                            
                                Microsoft.Insights/diagnosticSettings/metrics[*].enabled
                                microsoft.insights
                                diagnosticSettings
                                properties.metrics[*].enabled
                                True
                                
                                False
-Alias
+Modifiable
-Microsoft.Insights/diagnosticSettings/logs[*].enabled
+False
-Microsoft.Insights/diagnosticSettings/metrics[*].enabled
+False
-Rule resource types
+                IF (1)

                                    Microsoft.Sql/servers/databases
-Compliance
+                    Not a Compliance control
-Initiatives usage
+                none
-History
+                                Date/Time (UTC ymd) (i)
                                Change type
                                Change detail
                            
                                                    
                                2021-05-11 14:06:18
                                change
                                Minor (1.1.0 > 1.2.0)
-Date/Time (UTC ymd) (i)
+Change detail
--05-11 14:06:18
+Minor (1.1.0 > 1.2.0)
-JSON compare
+    "policyType": "BuiltIn",
@@ -3,9 +3,9 @@
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Deploys the diagnostic settings for Azure SQL Database to stream to a regional Event Hub on any Azure SQL Database which is missing this diagnostic settings is created or updated.",
     "metadata": {
-        "version": "1.1.0",
         "category": "SQL"
     },
     "parameters": {
         "profileName": {
@@ -62,13 +62,13 @@
                 "name": "[parameters('profileName')]",
                 "existenceCondition": {
                     "allOf": [
                         {
-                            "field": "Microsoft.Insights/diagnosticSettings/logs.enabled",
                             "equals": "[parameters('logsEnabled')]"
                         },
                         {
-                            "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
                             "equals": "[parameters('metricsEnabled')]"
                         }
                     ]
                 },
@@ -159,8 +159,12 @@
                                             },
                                             {
                                                 "category": "Deadlocks",
                                                 "enabled": "[parameters('logsEnabled')]"
                                             }
                                         ]
                                     }
                                 }
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Deploys the diagnostic settings for Azure SQL Database to stream to a regional Event Hub on any Azure SQL Database which is missing this diagnostic settings is created or updated.",
     "metadata": {
+        "version": "1.2.0",
         "category": "SQL"
     },
     "parameters": {
         "profileName": {
                 "name": "[parameters('profileName')]",
                 "existenceCondition": {
                     "allOf": [
                         {
+                            "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
                             "equals": "[parameters('logsEnabled')]"
                         },
                         {
+                            "field": "Microsoft.Insights/diagnosticSettings/metrics[*].enabled",
                             "equals": "[parameters('metricsEnabled')]"
                         }
                     ]
                 },
                                             },
                                             {
                                                 "category": "Deadlocks",
                                                 "enabled": "[parameters('logsEnabled')]"
+                                            },
+                                            {
+                                                "category": "DevOpsOperationsAudit",
+                                                "enabled": "[parameters('logsEnabled')]"
                                             }
                                         ]
                                     }
                                 }
-JSON
+                                api-version=2021-06-01

                                  EPAC
                                
                            
                        
                        
                            
                                {7 itemsdisplayName: "Deploy Diagnostic Settings for Azure SQL Database to Event Hub",
policyType: "BuiltIn",
mode: "Indexed",
description: "Deploys the diagnostic settings for Azure SQL Database to stream to a regional Event Hub on any Azure SQL Database which is missing this diagnostic settings is created or updated.",
metadata: {2 itemsversion: "1.2.0",
category: "SQL"
},
parameters: {4 itemsprofileName: {3 itemstype: "String",
metadata: {2 itemsdisplayName: "Profile name",
description: "The diagnostic settings profile name"
},
defaultValue: "setbypolicy"
},
eventHubRuleId: {2 itemstype: "String",
metadata: {4 itemsdisplayName: "Event Hub Authorization Rule Id",
description: "The Event Hub authorization rule Id for Azure Diagnostics. The authorization rule needs to be at Event Hub namespace level. e.g. /subscriptions/{subscription Id}/resourceGroups/{resource group}/providers/Microsoft.EventHub/namespaces/{Event Hub namespace}/authorizationrules/{authorization rule}",
strongType: "Microsoft.EventHub/Namespaces/AuthorizationRules",
assignPermissions: true
}
},
metricsEnabled: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Enable metrics",
description: "Whether to enable metrics stream to the Event Hub - True or False"
},
allowedValues: [2 items"True",
"False"
],
defaultValue: "False"
},
logsEnabled: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Enable logs",
description: "Whether to enable logs stream to the Event Hub  - True or False"
},
allowedValues: [2 items"True",
"False"
],
defaultValue: "True"
}
},
policyRule: {2 itemsif: {2 itemsfield: "type",
equals: "Microsoft.Sql/servers/databases"
},
then: {2 itemseffect: "DeployIfNotExists",
details: {5 itemstype: "Microsoft.Insights/diagnosticSettings",
name: "[parameters('profileName')]",
existenceCondition: {1 itemallOf: [2 items{2 itemsfield: "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
equals: "[parameters('logsEnabled')]"
},
{2 itemsfield: "Microsoft.Insights/diagnosticSettings/metrics[*].enabled",
equals: "[parameters('metricsEnabled')]"
}
]
},
roleDefinitionIds: [1 item"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" Contributor 
],
deployment: {1 itemproperties: {3 itemsmode: "incremental",
template: {5 items$schema: "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
contentVersion: "1.0.0.0",
parameters: {6 itemsfullName: {1 itemtype: "string"
},
location: {1 itemtype: "string"
},
eventHubRuleId: {1 itemtype: "string"
},
metricsEnabled: {1 itemtype: "string"
},
logsEnabled: {1 itemtype: "string"
},
profileName: {1 itemtype: "string"
}
},
resources: [1 item{6 itemstype: "Microsoft.Sql/servers/databases/providers/diagnosticSettings",
apiVersion: "2017-05-01-preview",
name: 🔍"[
    concat(
        parameters('fullName'),
       '/',
        'Microsoft.Insights/',
         parameters('profileName')
    )
]",
location: "[parameters('location')]",
dependsOn: [],
properties: {3 itemseventHubAuthorizationRuleId: "[parameters('eventHubRuleId')]",
metrics: [1 item{3 itemscategory: "AllMetrics",
enabled: "[parameters('metricsEnabled')]",
retentionPolicy: {2 itemsenabled: false,
days: 0
}
}
],
logs: [11 items{2 itemscategory: "QueryStoreRuntimeStatistics",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "QueryStoreWaitStatistics",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Errors",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "DatabaseWaitStatistics",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Blocks",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "SQLInsights",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "SQLSecurityAuditEvents",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Timeouts",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "AutomaticTuning",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Deadlocks",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "DevOpsOperationsAudit",
enabled: "[parameters('logsEnabled')]"
}
]
}
}
],
outputs: {1 itempolicy: {2 itemstype: "string",
value: 🔍"[
    concat(
       'Enabled diagnostic settings for',
         parameters('fullName')
    )
]"
}
}
},
parameters: {6 itemslocation: {1 itemvalue: "[field('location')]"
},
fullName: {1 itemvalue: "[field('fullName')]"
},
eventHubRuleId: {1 itemvalue: "[parameters('eventHubRuleId')]"
},
metricsEnabled: {1 itemvalue: "[parameters('metricsEnabled')]"
},
logsEnabled: {1 itemvalue: "[parameters('logsEnabled')]"
},
profileName: {1 itemvalue: "[parameters('profileName')]"
}
}
}
}
}
}
}
}
                                 api-version=2021-06-01

                                  EPAC
                                 {7 itemsdisplayName: "Deploy Diagnostic Settings for Azure SQL Database to Event Hub",
policyType: "BuiltIn",
mode: "Indexed",
description: "Deploys the diagnostic settings for Azure SQL Database to stream to a regional Event Hub on any Azure SQL Database which is missing this diagnostic settings is created or updated.",
metadata: {2 itemsversion: "1.2.0",
category: "SQL"
},
parameters: {4 itemsprofileName: {3 itemstype: "String",
metadata: {2 itemsdisplayName: "Profile name",
description: "The diagnostic settings profile name"
},
defaultValue: "setbypolicy"
},
eventHubRuleId: {2 itemstype: "String",
metadata: {4 itemsdisplayName: "Event Hub Authorization Rule Id",
description: "The Event Hub authorization rule Id for Azure Diagnostics. The authorization rule needs to be at Event Hub namespace level. e.g. /subscriptions/{subscription Id}/resourceGroups/{resource group}/providers/Microsoft.EventHub/namespaces/{Event Hub namespace}/authorizationrules/{authorization rule}",
strongType: "Microsoft.EventHub/Namespaces/AuthorizationRules",
assignPermissions: true
}
},
metricsEnabled: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Enable metrics",
description: "Whether to enable metrics stream to the Event Hub - True or False"
},
allowedValues: [2 items"True",
"False"
],
defaultValue: "False"
},
logsEnabled: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Enable logs",
description: "Whether to enable logs stream to the Event Hub  - True or False"
},
allowedValues: [2 items"True",
"False"
],
defaultValue: "True"
}
},
policyRule: {2 itemsif: {2 itemsfield: "type",
equals: "Microsoft.Sql/servers/databases"
},
then: {2 itemseffect: "DeployIfNotExists",
details: {5 itemstype: "Microsoft.Insights/diagnosticSettings",
name: "[parameters('profileName')]",
existenceCondition: {1 itemallOf: [2 items{2 itemsfield: "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
equals: "[parameters('logsEnabled')]"
},
{2 itemsfield: "Microsoft.Insights/diagnosticSettings/metrics[*].enabled",
equals: "[parameters('metricsEnabled')]"
}
]
},
roleDefinitionIds: [1 item"/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" Contributor 
],
deployment: {1 itemproperties: {3 itemsmode: "incremental",
template: {5 items$schema: "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
contentVersion: "1.0.0.0",
parameters: {6 itemsfullName: {1 itemtype: "string"
},
location: {1 itemtype: "string"
},
eventHubRuleId: {1 itemtype: "string"
},
metricsEnabled: {1 itemtype: "string"
},
logsEnabled: {1 itemtype: "string"
},
profileName: {1 itemtype: "string"
}
},
resources: [1 item{6 itemstype: "Microsoft.Sql/servers/databases/providers/diagnosticSettings",
apiVersion: "2017-05-01-preview",
name: 🔍"[
    concat(
        parameters('fullName'),
       '/',
        'Microsoft.Insights/',
         parameters('profileName')
    )
]",
location: "[parameters('location')]",
dependsOn: [],
properties: {3 itemseventHubAuthorizationRuleId: "[parameters('eventHubRuleId')]",
metrics: [1 item{3 itemscategory: "AllMetrics",
enabled: "[parameters('metricsEnabled')]",
retentionPolicy: {2 itemsenabled: false,
days: 0
}
}
],
logs: [11 items{2 itemscategory: "QueryStoreRuntimeStatistics",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "QueryStoreWaitStatistics",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Errors",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "DatabaseWaitStatistics",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Blocks",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "SQLInsights",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "SQLSecurityAuditEvents",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Timeouts",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "AutomaticTuning",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "Deadlocks",
enabled: "[parameters('logsEnabled')]"
},
{2 itemscategory: "DevOpsOperationsAudit",
enabled: "[parameters('logsEnabled')]"
}
]
}
}
],
outputs: {1 itempolicy: {2 itemstype: "string",
value: 🔍"[
    concat(
       'Enabled diagnostic settings for',
         parameters('fullName')
    )
]"
}
}
},
parameters: {6 itemslocation: {1 itemvalue: "[field('location')]"
},
fullName: {1 itemvalue: "[field('fullName')]"
},
eventHubRuleId: {1 itemvalue: "[parameters('eventHubRuleId')]"
},
metricsEnabled: {1 itemvalue: "[parameters('metricsEnabled')]"
},
logsEnabled: {1 itemvalue: "[parameters('logsEnabled')]"
},
profileName: {1 itemvalue: "[parameters('profileName')]"
}
}
}
}
}
}
}
}