Amending log analytics attributes

.devcontainer/devcontainer.json

@@ -0,0 +1,26 @@
+{
+  "image": "mcr.microsoft.com/azterraform:latest",
+
+  "runArgs": [
+		"--cap-add=SYS_PTRACE",
+		"--security-opt",
+		"seccomp=unconfined",
+		"--init",
+		"--network=host"
+	],
+
+	"mounts": [ "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind" ],
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "go.toolsManagement.checkForUpdates": "local",
+        "go.useLanguageServer": true,
+        "go.goroot": "/usr/local/go"
+      },
+      "extensions": [
+        "hashicorp.terraform",
+        "golang.Go"
+      ]
+    }
+  }
+}

README.md

@@ -344,7 +344,17 @@ No modules.
 | <a name="input_location"></a> [location](#input\_location) | Location of cluster, if not defined it will be read from the resource-group | `string` | `null` | no |
 | <a name="input_log_analytics_solution"></a> [log\_analytics\_solution](#input\_log\_analytics\_solution) | (Optional) Object which contains existing azurerm\_log\_analytics\_solution ID. Providing ID disables creation of azurerm\_log\_analytics\_solution. | <pre>object({<br>    id = string<br>  })</pre> | `null` | no |
 | <a name="input_log_analytics_workspace"></a> [log\_analytics\_workspace](#input\_log\_analytics\_workspace) | (Optional) Existing azurerm\_log\_analytics\_workspace to attach azurerm\_log\_analytics\_solution. Providing the config disables creation of azurerm\_log\_analytics\_workspace. | <pre>object({<br>    id                  = string<br>    name                = string<br>    location            = optional(string)<br>    resource_group_name = optional(string)<br>  })</pre> | `null` | no |
+| <a name="input_log_analytics_workspace_allow_resource_only_permissions"></a> [log\_analytics\_workspace\_allow\_resource\_only\_permissions](#input\_log\_analytics\_workspace\_allow\_resource\_only\_permissions) | (Optional) Specifies if the log Analytics Workspace allow users accessing to data associated with resources they have permission to view, without permission to workspace. Defaults to `true`. | `bool` | `null` | no |
+| <a name="input_log_analytics_workspace_cmk_for_query_forced"></a> [log\_analytics\_workspace\_cmk\_for\_query\_forced](#input\_log\_analytics\_workspace\_cmk\_for\_query\_forced) | (Optional) Is Customer Managed Storage mandatory for query management? | `bool` | `null` | no |
+| <a name="input_log_analytics_workspace_daily_quota_gb"></a> [log\_analytics\_workspace\_daily\_quota\_gb](#input\_log\_analytics\_workspace\_daily\_quota\_gb) | (Optional) The workspace daily quota for ingestion in GB. Defaults to -1 (unlimited) if omitted. | `number` | `null` | no |
+| <a name="input_log_analytics_workspace_data_collection_rule_id"></a> [log\_analytics\_workspace\_data\_collection\_rule\_id](#input\_log\_analytics\_workspace\_data\_collection\_rule\_id) | (Optional) The ID of the Data Collection Rule to use for this workspace. | `string` | `null` | no |
 | <a name="input_log_analytics_workspace_enabled"></a> [log\_analytics\_workspace\_enabled](#input\_log\_analytics\_workspace\_enabled) | Enable the integration of azurerm\_log\_analytics\_workspace and azurerm\_log\_analytics\_solution: https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-onboard | `bool` | `true` | no |
+| <a name="input_log_analytics_workspace_identity"></a> [log\_analytics\_workspace\_identity](#input\_log\_analytics\_workspace\_identity) | - `identity_ids` - (Optional) Specifies a list of user managed identity ids to be assigned. Required if `type` is `UserAssigned`.<br>- `type` - (Required) Specifies the identity type of the Log Analytics Workspace. Possible values are `SystemAssigned` (where Azure will generate a Service Principal for you) and `UserAssigned` where you can specify the Service Principal IDs in the `identity_ids` field. | <pre>object({<br>    identity_ids = optional(set(string))<br>    type         = string<br>  })</pre> | `null` | no |
+| <a name="input_log_analytics_workspace_immediate_data_purge_on_30_days_enabled"></a> [log\_analytics\_workspace\_immediate\_data\_purge\_on\_30\_days\_enabled](#input\_log\_analytics\_workspace\_immediate\_data\_purge\_on\_30\_days\_enabled) | (Optional) Whether to remove the data in the Log Analytics Workspace immediately after 30 days. | `bool` | `null` | no |
+| <a name="input_log_analytics_workspace_internet_ingestion_enabled"></a> [log\_analytics\_workspace\_internet\_ingestion\_enabled](#input\_log\_analytics\_workspace\_internet\_ingestion\_enabled) | (Optional) Should the Log Analytics Workspace support ingestion over the Public Internet? Defaults to `true`. | `bool` | `null` | no |
+| <a name="input_log_analytics_workspace_internet_query_enabled"></a> [log\_analytics\_workspace\_internet\_query\_enabled](#input\_log\_analytics\_workspace\_internet\_query\_enabled) | (Optional) Should the Log Analytics Workspace support querying over the Public Internet? Defaults to `true`. | `bool` | `null` | no |
+| <a name="input_log_analytics_workspace_local_authentication_disabled"></a> [log\_analytics\_workspace\_local\_authentication\_disabled](#input\_log\_analytics\_workspace\_local\_authentication\_disabled) | (Optional) Specifies if the log Analytics workspace should enforce authentication using Azure AD. Defaults to `false`. | `bool` | `null` | no |
+| <a name="input_log_analytics_workspace_reservation_capacity_in_gb_per_day"></a> [log\_analytics\_workspace\_reservation\_capacity\_in\_gb\_per\_day](#input\_log\_analytics\_workspace\_reservation\_capacity\_in\_gb\_per\_day) | (Optional) The capacity reservation level in GB for this workspace. Possible values are `100`, `200`, `300`, `400`, `500`, `1000`, `2000` and `5000`. | `number` | `null` | no |
 | <a name="input_log_analytics_workspace_resource_group_name"></a> [log\_analytics\_workspace\_resource\_group\_name](#input\_log\_analytics\_workspace\_resource\_group\_name) | (Optional) Resource group name to create azurerm\_log\_analytics\_solution. | `string` | `null` | no |
 | <a name="input_log_analytics_workspace_sku"></a> [log\_analytics\_workspace\_sku](#input\_log\_analytics\_workspace\_sku) | The SKU (pricing level) of the Log Analytics workspace. For new subscriptions the SKU should be set to PerGB2018 | `string` | `"PerGB2018"` | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period for the logs in days | `number` | `30` | no |

log_analytics.tf

@@ -1,11 +1,20 @@
 resource "azurerm_log_analytics_workspace" "main" {
   count = local.create_analytics_workspace ? 1 : 0
 
-  location            = coalesce(var.location, data.azurerm_resource_group.main.location)
-  name                = coalesce(var.cluster_log_analytics_workspace_name, trim("${var.prefix}-workspace", "-"))
-  resource_group_name = coalesce(var.log_analytics_workspace_resource_group_name, var.resource_group_name)
-  retention_in_days   = var.log_retention_in_days
-  sku                 = var.log_analytics_workspace_sku
+  location                                = coalesce(var.location, data.azurerm_resource_group.main.location)
+  name                                    = coalesce(var.cluster_log_analytics_workspace_name, trim("${var.prefix}-workspace", "-"))
+  resource_group_name                     = coalesce(var.log_analytics_workspace_resource_group_name, var.resource_group_name)
+  allow_resource_only_permissions         = var.log_analytics_workspace_allow_resource_only_permissions
+  cmk_for_query_forced                    = var.log_analytics_workspace_cmk_for_query_forced
+  daily_quota_gb                          = var.log_analytics_workspace_daily_quota_gb
+  data_collection_rule_id                 = var.log_analytics_workspace_data_collection_rule_id
+  immediate_data_purge_on_30_days_enabled = var.log_analytics_workspace_immediate_data_purge_on_30_days_enabled
+  internet_ingestion_enabled              = var.log_analytics_workspace_internet_ingestion_enabled
+  internet_query_enabled                  = var.log_analytics_workspace_internet_query_enabled
+  local_authentication_disabled           = var.log_analytics_workspace_local_authentication_disabled
+  reservation_capacity_in_gb_per_day      = var.log_analytics_workspace_reservation_capacity_in_gb_per_day
+  retention_in_days                       = var.log_retention_in_days
+  sku                                     = var.log_analytics_workspace_sku
   tags = merge(var.tags, (/*<box>*/ (var.tracing_tags_enabled ? { for k, v in /*</box>*/ {
     avm_git_commit           = "0ae8a663f1dc1dc474b14c10d9c94c77a3d1e234"
     avm_git_file             = "main.tf"
@@ -17,6 +26,14 @@ resource "azurerm_log_analytics_workspace" "main" {
     avm_yor_name = "main"
   } /*<box>*/ : replace(k, "avm_", var.tracing_tags_prefix) => v } : {}) /*</box>*/))
 
+  dynamic "identity" {
+    for_each = var.log_analytics_workspace_identity == null ? [] : [var.log_analytics_workspace_identity]
+    content {
+      type         = identity.value.type
+      identity_ids = identity.value.identity_ids
+    }
+  }
+
   lifecycle {
     precondition {
       condition     = can(coalesce(var.cluster_log_analytics_workspace_name, var.prefix))

variables.tf

@@ -680,13 +680,79 @@ variable "log_analytics_workspace" {
   description = "(Optional) Existing azurerm_log_analytics_workspace to attach azurerm_log_analytics_solution. Providing the config disables creation of azurerm_log_analytics_workspace."
 }
 
+variable "log_analytics_workspace_allow_resource_only_permissions" {
+  type        = bool
+  default     = null
+  description = "(Optional) Specifies if the log Analytics Workspace allow users accessing to data associated with resources they have permission to view, without permission to workspace. Defaults to `true`."
+}
+
+variable "log_analytics_workspace_cmk_for_query_forced" {
+  type        = bool
+  default     = null
+  description = "(Optional) Is Customer Managed Storage mandatory for query management?"
+}
+
+variable "log_analytics_workspace_daily_quota_gb" {
+  type        = number
+  default     = null
+  description = "(Optional) The workspace daily quota for ingestion in GB. Defaults to -1 (unlimited) if omitted."
+}
+
+variable "log_analytics_workspace_data_collection_rule_id" {
+  type        = string
+  default     = null
+  description = "(Optional) The ID of the Data Collection Rule to use for this workspace."
+}
+
 variable "log_analytics_workspace_enabled" {
   type        = bool
   default     = true
   description = "Enable the integration of azurerm_log_analytics_workspace and azurerm_log_analytics_solution: https://docs.microsoft.com/en-us/azure/azure-monitor/containers/container-insights-onboard"
   nullable    = false
 }
 
+variable "log_analytics_workspace_identity" {
+  type = object({
+    identity_ids = optional(set(string))
+    type         = string
+  })
+  default     = null
+  description = <<-EOT
+ - `identity_ids` - (Optional) Specifies a list of user managed identity ids to be assigned. Required if `type` is `UserAssigned`.
+ - `type` - (Required) Specifies the identity type of the Log Analytics Workspace. Possible values are `SystemAssigned` (where Azure will generate a Service Principal for you) and `UserAssigned` where you can specify the Service Principal IDs in the `identity_ids` field.
+EOT
+}
+
+variable "log_analytics_workspace_immediate_data_purge_on_30_days_enabled" {
+  type        = bool
+  default     = null
+  description = "(Optional) Whether to remove the data in the Log Analytics Workspace immediately after 30 days."
+}
+
+variable "log_analytics_workspace_internet_ingestion_enabled" {
+  type        = bool
+  default     = null
+  description = "(Optional) Should the Log Analytics Workspace support ingestion over the Public Internet? Defaults to `true`."
+}
+
+variable "log_analytics_workspace_internet_query_enabled" {
+  type        = bool
+  default     = null
+  description = "(Optional) Should the Log Analytics Workspace support querying over the Public Internet? Defaults to `true`."
+}
+
+variable "log_analytics_workspace_local_authentication_disabled" {
+  type        = bool
+  default     = null
+  description = "(Optional) Specifies if the log Analytics workspace should enforce authentication using Azure AD. Defaults to `false`."
+}
+
+variable "log_analytics_workspace_reservation_capacity_in_gb_per_day" {
+  type        = number
+  default     = null
+  description = "(Optional) The capacity reservation level in GB for this workspace. Possible values are `100`, `200`, `300`, `400`, `500`, `1000`, `2000` and `5000`."
+}
+
 variable "log_analytics_workspace_resource_group_name" {
   type        = string
   default     = null