mgmt-infra: enable audit logging for cx, msi and mgmt key vaults

Azure · Feb 20, 2025 · 92ddca0 · 92ddca0
1 parent f71080c
commit 92ddca0
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 0 deletions.
diff --git a/dev-infrastructure/configurations/mgmt-infra.tmpl.bicepparam b/dev-infrastructure/configurations/mgmt-infra.tmpl.bicepparam
@@ -24,3 +24,6 @@ param aroDevopsMsiId = '{{ .aroDevopsMsiId }}'
 // Cluster Service identity
 // used for Key Vault access
 param clusterServiceMIResourceId = '__clusterServiceMIResourceId__'
+
+// Log Analytics Workspace ID will be passed from global pipeline if enabled in config
+param logAnalyticsWorkspaceId = '__logAnalyticsWorkspaceId__'
diff --git a/dev-infrastructure/mgmt-pipeline.yaml b/dev-infrastructure/mgmt-pipeline.yaml
@@ -42,7 +42,12 @@ resourceGroups:
       input:
         step: svc-output
         name: cs
+    - name: logAnalyticsWorkspaceId
+      input:
+        step: global-output
+        name: logAnalyticsWorkspaceId 
     dependsOn:
+    - global-output
     - svc-output
   # Configure certificate issuers for the MC KVs
   - name: cx-oncert-public-kv-issuer

diff --git a/dev-infrastructure/templates/mgmt-infra.bicep b/dev-infrastructure/templates/mgmt-infra.bicep
@@ -40,6 +40,9 @@ param kvCertOfficerPrincipalId string
 @description('MSI that will be used during pipeline runs')
 param aroDevopsMsiId string
 
+// Log Analytics Workspace ID will be passed from global pipeline if enabled in config
+param logAnalyticsWorkspaceId string = ''
+
 resource resourcegroupTags 'Microsoft.Resources/tags@2024-03-01' = {
   name: 'default'
   scope: resourceGroup()
@@ -80,6 +83,7 @@ module cxKeyVault '../modules/keyvault/keyvault.bicep' = {
     private: cxKeyVaultPrivate
     enableSoftDelete: cxKeyVaultSoftDelete
     purpose: 'cx'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspaceId
   }
 }
 
@@ -110,6 +114,7 @@ module msiKeyVault '../modules/keyvault/keyvault.bicep' = {
     private: msiKeyVaultPrivate
     enableSoftDelete: msiKeyVaultSoftDelete
     purpose: 'msi'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspaceId
   }
 }
 
@@ -123,6 +128,8 @@ module mgmtKeyVault '../modules/keyvault/keyvault.bicep' = {
     private: mgmtKeyVaultPrivate
     enableSoftDelete: mgmtKeyVaultSoftDelete
     purpose: 'mgmt'
+    logAnalyticsWorkspaceId: logAnalyticsWorkspaceId
+
   }
 }