Azure Monitor Baseline Alerts

Deprecation Notice for AMBA Guidance

[!WARNING] The guidance for Azure Monitor Baseline Alerts (AMBA) provided here is specific to the classic version of the ALZ Bicep Accelerator, which has been deprecated. It is not integrated into the newer version of the ALZ-Bicep Accelerator, but integration is currently in on the roadmap for the near future.

In the meantime, if you prefer not to wait for this integration, you can deploy AMBA as a standalone deployment. This option may be optimal, particularly if you initially deployed the classic ALZ-Bicep framework using the PowerShell or Azure CLI scripts found in the module READMEs. Follow the guidance provided in the AMBA documentation for standalone deployment.

Pre-Requisites

Please ensure you have deployed the initial Accelerator and meet all prerequisites outlined in the AMBA prerequisites section for ALZ.

Integration Steps

Note: The following guidance assumes that no changes to the policies are needed or have already been applied. If you need to make changes to the policies, please refer to the AMBA documentation for guidance.

The first integration step to perform is to clone AMBA to your local machine.
Navigate to patterns\alz in the cloned AMBA repository and copy the following directories and files:
- policyAssignments
- policyDefinitions
- policySetDefinitions
- templates
- alzARM.json
Paste the copied directories and files into a new directoy called amba within the config\custom-modules directory of your ALZ-Bicep Accelerator repository.
Navigate back to patterns\alz in the cloned AMBA repository and copy the alzARM.param.json file.
Paste the copied alzARM.param.json file into the config\custom-parameters directory of your ALZ-Bicep Accelerator repository.
Modify the alzARM.param.json file to incorporate your landing zone configuration. You can use the AMBA Parameter Configuration guidance as a reference point to understand how to configure the parameters.
Next, go into pipeline-scripts and create a new script called Deploy-AMBA.ps1, which will be used to deploy the AMBA resources and called within your GitHub Actions Workflow or Azure Pipeline.

Add the following code to the Deploy-AMBA.ps1 script:

param (
  [Parameter()]
  [String]$Location = "$($env:LOCATION)",

  [Parameter()]
  [String]$TopLevelMGPrefix = "$($env:TOP_LEVEL_MG_PREFIX)",

  [Parameter()]
  [String]$TemplateURI = "https://raw.githubusercontent.com/Azure/azure-monitor-baseline-alerts/main/patterns/alz/alzArm.json",

  [Parameter()]
  [String]$TemplateParameterFile = "config\custom-parameters\alzArm.param.json",

  [Parameter()]
  [Boolean]$WhatIfEnabled = [System.Convert]::ToBoolean($($env:IS_PULL_REQUEST))
)

# Parameters necessary for deployment
$inputObject = @{
  DeploymentName        = -join ('alz-AMBADeploy-{0}' -f (Get-Date -Format 'yyyyMMddTHHMMssffffZ'))[0..63]
  Location              = $Location
  ManagementGroupId     = $TopLevelMGPrefix
  TemplateURI           = $TemplateURI
  TemplateParameterFile = $TemplateParameterFile
  WhatIf                = $WhatIfEnabled
  Verbose               = $true
}

New-AzManagementGroupDeployment @inputObject

Next, navigate to either .azuredevOps\pipelines or .github\workflows and open the alz-bicep-1-core.yml file.

Depending upon which CI/CD platform you are using, you will need to modify the alz-bicep-1-core.yml file to include the following step after the Management Group deployment:

GitHub Action to Add (alz-bicep-1-core.yml)

- name: "AMBA Deployment"
      uses: azure/powershell@v1
      with:
        inlineScript: |
          .\pipeline-scripts\Deploy-AMBA.ps1          
        azPSVersion: "latest"

Azure Pipeline Task to Add (alz-bicep-1-core.yml)

- task: AzurePowerShell@5
      displayName: "AMBA Deployment"
      inputs:
        azureSubscription: ${{ variables.SERVICE_CONNECTION_NAME }}
        azurePowerShellVersion: "LatestVersion"
        pwsh: true
        ScriptType: "InlineScript"
        Inline: |
          .\pipeline-scripts\Deploy-AMBA.ps1

Within the same alz-bicep-1-core.yml file, modify the path based triggers to include the config/custom-modules/amba/*** directory and the config/custom-parameters/amba.parameters.all.json file. This will ensure that any changes to the AMBA resources will trigger a new build.

Note: For Azure Pipelines, if you are using Azure Repos as your repository, you will need to edit the branch policy of the main branch to include the path based filters.
Finally, commit the changes to your upstream repository, which will trigger a new build to deploy the AMBA resources.

Tip: If you have any issues with the deployment, please open an issue an issue within ALZ-Bicep

This wiki is being actively developed

If you discover any documentation bugs or would like to request new content, please raise them as an issue on the repo.

Contributions to this wiki are done through the main repo under docs/wiki.

Azure Monitor Baseline Alerts

Deprecation Notice for AMBA Guidance

Pre-Requisites

Integration Steps

Wiki Navigation

This wiki is being actively developed