Exclude specific resource types from the `Audit diagnostic setting for selected resource types` policy¶

Context and Problem Statement¶

The ISO 27001:2013 policy initiative uses the Audit diagnostic setting for selected resource types policy to check that diagnostic settings have been configured for a range of resource types. However, the microsoft.automation/automationaccounts, microsoft.keyvault/vaults, microsoft.network/networkinterfaces, and microsoft.network/publicipaddresses resource types have a different structure for the microsoft.insights/diagnosticSettings resource. This causes the Audit diagnostic setting for selected resource types even though we have enabled the allLogs category where possible.

For microsoft.automation/automationaccounts, microsoft.keyvault/vaults, microsoft.network/publicipaddresses, and microsoft.network/networkinterfaces

For microsoft.network/networkinterfaces the difference is:

"properties": {
-   "logs": [
-       {
-           "category": null,
-           "categoryGroup": "allLogs",
-           "enabled": true,
-           "retentionPolicy": {
-               "days": 0,
-               "enabled": false
-           }
-       }
-   ],
+   "logs": [],
    "metrics": [
        {
            "timeGrain": null,
            "enabled": true,
            "retentionPolicy": {
                "days": 0,
                "enabled": false
            },
            "category": "AllMetrics"
        }
    ]
}

microsoft.automation/automationaccounts, microsoft.keyvault/vaults, and microsoft.network/publicipaddresses the difference is

"properties": {
        "logs": [
+           {
+               "category": null,
+               "categoryGroup": "audit",
+               "enabled": false,
+               "retentionPolicy": {
+                   "days": 0,
+                   "enabled": false
+               }
+           },            
            {
                "category": null,
                "categoryGroup": "allLogs",
                "enabled": true,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                }
            }
        ],
        "metrics": [
            {
                "timeGrain": null,
                "enabled": false,
                "retentionPolicy": {
                    "days": 0,
                    "enabled": false
                },
                "category": "AllMetrics"
            }
        ],

Decision Drivers¶

The requirement to be compliant with the ISO 27001:2013 compliance standard
The fact that we use a built-in policy set to configure allLogs for all required resources

Considered Options¶

Exempt the individual resources from the policy
Exclude the resource types from the policy

Decision Outcome¶

Chosen option: "Exclude the resource types from the policy", because it is the most straightforward and least error-prone solution. We are compliant with the ISO 27001:2013 compliance standard and because we use a built-in policy set to configure allLogs for all required resources. However, the Audit diagnostic setting for selected resource types policy does not take into account the different structure for the microsoft.insights/diagnosticSettings resource for the microsoft.automation/automationaccounts, microsoft.keyvault/vaults, microsoft.network/networkinterfaces, and microsoft.network/publicipaddresses resource types.

We decided to this temporarily until we have a better solution. In the meantime we have raised issues in the Azure built-in policy GitHub repository to address these issue.

Consequences¶

Good, because we do not have to manage individual exemptions for the individual resources
Bad, because the Enable diagnostic setting for selected resource types policy will no longer notify us if the allLogs category is not enabled for any of the excluded resource types

Validation¶

We will re-evaluate this decision at the end of this year.

Pros and Cons of the Options¶

Exempt the individual resources from the policy¶

Create exemptions for the individual resources that have a different structure for the microsoft.insights/diagnosticSettings resource.

Good, because this is the most explicit way to exempt the individual resources
Good, because we can specify an end date for the exemption
Bad, because it is cumbersome to create the individual exemptions for each of the resources

Exclude the resource types from the policy¶

Exclude the microsoft.automation/automationaccounts, microsoft.keyvault/vaults, microsoft.network/networkinterfaces, and microsoft.network/publicipaddresses resource types from the Audit diagnostic setting for selected resource types policy in the ISO 27001:2013 policy initiative assignment.

Good, because we prevent false positives in the Audit diagnostic setting for selected resource types policy for specific resource types
Bad, because we no longer see true positives in the Audit diagnostic setting for selected resource types policy for the excluded resource types

Exclude specific resource types from the Audit diagnostic setting for selected resource types policy¶