Diagnostic Settings for App Service & Function App

[SenthuranSivananthan]

Overview/Summary

App Service & Function App can be deployed in various scenarios such as Windows, Linux and in containers. Each scenario is represented as kind property and therefore each needs to be support for Diagnostic Setting policies.

The approach taken is to expand the existing policy definitions to include additional kinds. The scenarios now supported:

Kinds for App Service deployments

• app (Windows)
• app,linux (Linux)
• app,linux,container (Linux + Container)

Kinds for Function App deployments

• functionapp (Windows)
• functionapp,linux (Linux)
• functionapp,linux,container (Linux + Container)

This is made possible because there are no configuration change between the kinds in each type of deployment. It was verified by:

1. Deploying each type of scenario
2. Execute Policy Generation Script
3. Diff between the scenarios to verify

App Service

# Comparing Windows & Linux App Service
diff Apply-Diag-Settings-LA-Microsoft.Web-sites-app/azurepolicy.rules.json Apply-Diag-Settings-LA-Microsoft.Web-sites-app-linux/azurepolicy.rules.json
14c14
<         "equals": "app"
---
>         "equals": "app,linux"


# Comparing Windows & Linux + Container App Service
diff Apply-Diag-Settings-LA-Microsoft.Web-sites-app/azurepolicy.rules.json Apply-Diag-Settings-LA-Microsoft.Web-sites-app-linux-container/azurepolicy.rules.json
14c14
<         "equals": "app"
---
>         "equals": "app,linux,container"

Function App

# Comparing Windows & Linux Function App
diff Apply-Diag-Settings-LA-Microsoft.Web-sites-functionapp/azurepolicy.rules.json Apply-Diag-Settings-LA-Microsoft.Web-sites-functionapp-linux/azurepolicy.rules.json
14c14
<         "equals": "functionapp"
---
>         "equals": "functionapp,linux"

# Comparing Windows & Linux + Container Function App
diff Apply-Diag-Settings-LA-Microsoft.Web-sites-functionapp/azurepolicy.rules.json Apply-Diag-Settings-LA-Microsoft.Web-sites-functionapp-linux-container/azurepolicy.rules.json
14c14
<         "equals": "functionapp"
---
>         "equals": "functionapp,linux,container"

This PR fixes/adds/changes/removes

Expands on #133 to support additional scenarios.

Fixes #132

Breaking Changes

None

Testing Evidence

Ensure policies are updated with the revised rules:

Ensure policy evaluation identifies resources that requires diagnostic settings across each scenario:

To manually trigger a policy scan

az policy state trigger-scan --subscription <<SUB_ID>>

Remediate non-compliant resources

Verify diagnostic settings turned on

As part of this Pull Request I have

• Checked for duplicate Pull Requests
• Associated it with relevant GitHub Issues
• Ensured my code/branch is up-to-date with the latest changes in the main branch
• Performed testing and provided evidence.
• Updated relevant and associated documentation.

[hudua]

Looks good!