Define where private endpoints should be implemented in MLZ

[brooke-hamilton]

Benefit/Result/Outcome
So that private endpoints can be implemented with MLZ deployments.

Description
Determine which MLZ resources, e.g. log analytics workspaces, should be configured with private endpoints.

Acceptance Criteria

• A GitHub issue (or multiple issues) created for implementing private endpoints.

[glennmusa]

Some docs that might provide context https://docs.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security#hub-spoke-networks

[brooke-hamilton]

Candidate scope:

• Storage accounts
• Log Analytics
• Policy alerts for customer workloads that do not use private endpoints

[shawngib]

@glennmusa and @brooke-hamilton I think for Bicep this may be mostly answered. The current Central Logging PR #438 covers creating Azure Monitor Private Link. I categorize these into 3 buckets, Private Endpoints (AMPLS is one and is in PR), Service Endpoints (we currently do storage and not sure I see requirement currently for more) and Firewall tags (which we need to add AzureCloud allow portal and Azure access to get out of network. Seems we would also need to add NSG rules but a minor add. Since we have item #410 which will address firewall access we may be able to close this?