Add beyondTrustTenant parameter and update role assignments in Bicep …

…modules
FrodeHus · Dec 16, 2024 · f350168 · f350168
1 parent d73cf0a
commit f350168
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 4 deletions.
diff --git a/main.bicep b/main.bicep
@@ -9,6 +9,7 @@ type functionAppConfig = {
   keyvaultName: string
 }
 
+param beyondTrustTenant string
 param datacollection dataCollectionConfig
 param functionConfig functionAppConfig
 
@@ -30,6 +31,7 @@ module functionappModule './modules/functionapp.bicep' = {
       workspaceName: datacollectionModule.outputs.workspaceResourceId
       endpointImmutableId: datacollectionModule.outputs.dcrImmutableId
       endpointUri: datacollectionModule.outputs.logsIngestionEndpoint
+      beyondTrustTenant: beyondTrustTenant
     }
   }
 }
@@ -55,3 +57,13 @@ module workspaceReaderRoleAssignment './modules/workspace-role-assignment.bicep'
     workspaceName: datacollection.workspaceName
   }
 }
+
+module workspaceMetricPublisherRoleAssignment './modules/workspace-role-assignment.bicep' = {
+  name: 'workspaceMetricPublisherRoleAssignment'
+  params: {
+    roleAssignmentName: '${uniqueString(functionConfig.name)}-workspace-metric-publisher-role-assignment'
+    roleDefinitionId: '3913510d-42f4-4e42-8a64-420c390055eb' // Log Analytics Reader
+    principalId: principalId
+    workspaceName: datacollection.workspaceName
+  }
+}
diff --git a/main.bicepparam b/main.bicepparam
@@ -1,5 +1,5 @@
 using './main.bicep'
-
+param beyondTrustTenant = 'mytenant'
 param datacollection  = {
   ruleName: 'dcr-beyondtrust'
   endpointName: 'beyondtrust-endpoint'

diff --git a/modules/datacollection.bicep b/modules/datacollection.bicep
@@ -2,8 +2,11 @@ param ruleName string
 param endpointName string
 param workspaceName string
 
-var workspaceResourceId = resourceId('Microsoft.OperationalInsights/workspaces', workspaceName)
-output workspaceResourceId string = workspaceResourceId
+resource law 'Microsoft.OperationalInsights/workspaces@2023-09-01' existing = {
+  name: workspaceName
+}
+
+output workspaceId string = law.id
 
 resource dataCollectionEndpoint 'Microsoft.Insights/dataCollectionEndpoints@2023-03-11' = {
   name: endpointName
@@ -250,7 +253,7 @@ resource dataCollectionRule 'Microsoft.Insights/dataCollectionRules@2023-03-11'
     destinations: {
       logAnalytics: [
         {
-          workspaceResourceId: workspaceResourceId
+          workspaceResourceId: workspace.id
           name: 'beyondTrustWorkspace'
         }
       ]

diff --git a/modules/functionapp.bicep b/modules/functionapp.bicep
@@ -2,6 +2,7 @@ type dataCollectionConfig = {
   endpointImmutableId: string
   endpointUri: string
   workspaceName: string
+  beyondTrustTenant: string
 }
 
 param dataCollection dataCollectionConfig
@@ -100,6 +101,10 @@ resource functionApp 'Microsoft.Web/sites@2021-03-01' = {
           name: 'DCR_ENDPOINT'
           value: dataCollection.endpointUri
         }
+        {
+          name: 'BEYONDTRUST_TENANT'
+          value: dataCollection.beyondTrustTenant
+        }
       ]
       netFrameworkVersion: 'v9.0'  
       ftpsState: 'FtpsOnly'