JSON
Copy definition Copy definition 4 EPAC EPAC
{ 7 items policyType: "Custom" , mode: "All" , displayName: "Deploy Azure Monitor Baseline Alerts (AMBA-ALZ) - Activity Log LA Workspace Delete Alert" , description: "Policy to audit/deploy Activity Log LA Workspace Delete Alert" , metadata: { 5 items version: "1.1.1" , category: "Monitoring" , source: "https://github.com/Azure/azure-monitor-baseline-alerts/" , alzCloudEnvironments: [ 1 item ] , _deployed_by_amba: "True" } , parameters: { 7 items enabled: { 4 items } , alertResourceGroupName: { 3 items type: "String" , metadata: { 2 items displayName: "Resource Group Name" , description: "Resource group the alert is placed in" } , defaultValue: "rg-amba-monitoring-001" } , alertResourceGroupTags: { 3 items } , alertResourceGroupLocation: { 3 items type: "String" , metadata: { 2 items displayName: "Resource Group Location" , description: "Location of the Resource group the alert is placed in" } , defaultValue: "centralus" } , effect: { 4 items } , MonitorDisableTagName: { 3 items type: "String" , metadata: { 2 items displayName: "ALZ Monitoring disabled tag name" , description: "Tag name used to disable monitoring at the resource level. Set to true if monitoring should be disabled." } , defaultValue: "MonitorDisable" } , MonitorDisableTagValues: { 3 items type: "Array" , metadata: { 2 items displayName: "ALZ Monitoring disabled tag values(s)" , description: "Tag value(s) used to disable monitoring at the resource level. Set to true if monitoring should be disabled." } , defaultValue: [ 4 items "true" , "Test" , "Dev" , "Sandbox" ] } } , policyRule: { 2 items if: { 1 item allOf: [ 2 items { 2 items field: "type" , equals: "Microsoft.OperationalInsights/workspaces" } , { 2 items field: "[
concat(
'tags[
',
parameters('MonitorDisableTagName'),
'
]'
)
]" , notIn: "[parameters('MonitorDisableTagValues')]" } ] } , then: { 2 items effect: "[parameters('effect')]" , details: { 8 items roleDefinitionIds: [ 1 item "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c" Contributor ] , type: "Microsoft.Insights/activityLogAlerts" , name: "ActivityLAWorkspaceDelete" , existenceScope: "resourcegroup" , resourceGroupName: "[parameters('alertResourceGroupName')]" , deploymentScope: "subscription" , existenceCondition: { 1 item allOf: [ 2 items { 2 items field: "Microsoft.Insights/ActivityLogAlerts/enabled" , equals: "[parameters('enabled')]" } , { 2 items count: { 2 items field: "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*]" , where: { 1 item anyOf: [ 2 items { 1 item allOf: [ 2 items { 2 items field: "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].field" , equals: "category" } , { 2 items field: "Microsoft.Insights/ActivityLogAlerts/condition.allOf[*].equals" , equals: "Administrative" } ] } , { 1 item allOf: [ 2 items { 2 items field: "microsoft.insights/activityLogAlerts/condition.allOf[*].field" , equals: "operationName" } , { 2 items field: "microsoft.insights/activityLogAlerts/condition.allOf[*].equals" , equals: "Microsoft.OperationalInsights/workspaces/delete" } ] } ] } } , equals: 2 } ] } , deployment: { 2 items location: "northeurope" , properties: { 3 items mode: "incremental" , template: { 5 items $schema: "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#" , contentVersion: "1.0.0.0" , parameters: { 4 items } , variables : {} , resources: [ 2 items { 5 items type: "Microsoft.Resources/resourceGroups" , apiVersion: "2021-04-01" , name: "[parameters('alertResourceGroupName')]" , location: "[parameters('alertResourceGroupLocation')]" , tags: "[parameters('alertResourceGroupTags')]" } , { 6 items type: "Microsoft.Resources/deployments" , apiVersion: "2019-10-01" , name: "ActivityLAWorkspaceDelete" , resourceGroup: "[parameters('alertResourceGroupName')]" , dependsOn: [ 1 item 🔍 "[
concat(
'Microsoft.Resources/resourceGroups/',
parameters('alertResourceGroupName')
)
]"] , properties: { 3 items } } ] } , parameters: { 4 items } } } } } } }