Keyvault diagnostics in base workspace

CHANGELOG.md

@@ -15,6 +15,7 @@ ENHANCEMENTS:
 
 * Adding Log Analytics & Antimalware VM extensions ([#2520](https://github.com/microsoft/AzureTRE/pull/2520))
 * Gitea shared service support app-service standard SKUs ([#2523](https://github.com/microsoft/AzureTRE/pull/2523))
+* Keyvault diagnostic settings in base workspace ([#2521](https://github.com/microsoft/AzureTRE/pull/2521))
 
 BUG FIXES:
 

templates/workspaces/base/porter.yaml

@@ -1,6 +1,6 @@
 ---
 name: tre-workspace-base
-version: 0.3.25
+version: 0.3.26
 description: "A base Azure TRE workspace"
 dockerfile: Dockerfile.tmpl
 registry: azuretre
@@ -134,7 +134,7 @@ outputs:
 mixins:
   - exec
   - terraform:
-      clientVersion: 1.2.6
+      clientVersion: 1.2.7
   - az
 
 install:

templates/workspaces/base/terraform/keyvault.tf

@@ -43,6 +43,35 @@ resource "azurerm_private_endpoint" "kvpe" {
   }
 }
 
+resource "azurerm_monitor_diagnostic_setting" "kv" {
+  name                       = "diag-${local.keyvault_name}"
+  target_resource_id         = azurerm_key_vault.kv.id
+  log_analytics_workspace_id = module.azure_monitor.log_analytics_workspace_id
+
+  dynamic "log" {
+    for_each = toset(["AuditEvent", "AzurePolicyEvaluationDetails"])
+    content {
+      category = log.value
+      enabled  = true
+
+      retention_policy {
+        enabled = true
+        days    = 365
+      }
+    }
+  }
+
+  metric {
+    category = "AllMetrics"
+    enabled  = true
+
+    retention_policy {
+      enabled = true
+      days    = 365
+    }
+  }
+}
+
 data "azurerm_user_assigned_identity" "resource_processor_vmss_id" {
   name                = "id-vmss-${var.tre_id}"
   resource_group_name = "rg-${var.tre_id}"

templates/workspaces/base/terraform/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "=3.16.0"
+      version = "=3.19.1"
     }
     azuread = {
       source  = "hashicorp/azuread"

templates/workspaces/base/terraform/workspace.tf

@@ -74,5 +74,6 @@ module "azure_monitor" {
   enable_local_debugging                   = var.enable_local_debugging
   depends_on = [
     module.network,
+    module.airlock, # shouldn't be required, related to: https://github.com/microsoft/AzureTRE/issues/2357
   ]
 }