Diag Settings - AllLogs vs Audit

[Springstone]

Overview/Summary

This pull request introduces several updates to the Azure Landing Zones (ALZ) policies and configurations, focusing on enhancing security and logging capabilities. Key changes include the addition of new policy definitions, updates to existing policies, and the introduction of new configuration options in the eslzArm templates.

Policy Updates:

• Added a new built-in policy definition, Subnets should be private, to ensure subnets are secure by default by preventing default outbound access. [1] [2]

Documentation Updates:

• Updated the ALZ-Policies.md to reflect the new policy counts and the addition of the Subnets should be private policy. [1] [2]
• Updated Whats-new.md to include the addition of the new built-in policy assignment for Subnets should be private.

Template Updates:

• Introduced new parameters and options in eslzArm/eslz-portal.json to support the Subnets should be private policy, including a new options group for enabling this policy. [1] [2] [3]
• Updated eslzArm/eslzArm.json to add new parameters for enablePrivateSubnet and laCategory, and included new deployment conditions and URIs for the private subnet policy assignment. [1] [2] [3] [4] [5] [6]

Policy Assignment Updates:

• Modified DINE-ResourceDiagnosticsPolicyAssignment.json to include a new parameter laCategory for selecting the category of logs to be forwarded to Log Analytics. [1] [2]

Azure Public