自动化启用Azure Key Vault Audit及allLogs时遇PowerShell命令错误

我正尝试自动化为所有Azure Key Vault启用Audit和allLogs功能，目前所有Vault已配置diagnostic setting，剩余工作是启用Audit和allLogs日志。检查Azure policies后未找到可用的自动化修复计划，因此编写了如下PowerShell脚本：

# Connect to Azure
Connect-AzAccount

# Get all Azure subscriptions
$subscription = Get-AzSubscription -SubscriptionName 'my-sub'

# $subscription = Get-AzSubscription -SubscriptionId $subscriptionId  # Use this line if filtering by subscription ID

if ($subscription -eq $null) {
    Write-Output "Subscription not found."
    exit
}

# Set the current subscription context
Set-AzContext -SubscriptionId $subscription.Id


# Array to hold key vaults without diagnostic settings
$noDiagnosticSettingsKeyVaults = @()
# Array to hold key vaults with updated audit log settings
$updatedAuditLogSettingsKeyVaults = @()

# Get all Key Vaults in the specified subscription
$keyVaults = Get-AzKeyVault -VaultName 'kv-autom-dev-001'

foreach ($keyVault in $keyVaults) {
    # Get the diagnostic settings for the current Key Vault
    $diagnosticSettings = Get-AzDiagnosticSetting -ResourceId $keyVault.ResourceId

    if ($diagnosticSettings.Count -eq 0) {
        # If there are no diagnostic settings, add the key vault to the array
        $noDiagnosticSettingsKeyVaults += [PSCustomObject]@{
            KeyVaultName  = $keyVault.VaultName
            ResourceGroup = $keyVault.ResourceGroupName
            Subscription  = $subscription.Name
        }
    } else {
        # If diagnostic settings exist, ensure audit log settings are configured
        $logSettings = @()
        $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category "AuditEvent"
        $logSettings += New-AzDiagnosticSettingLogSettingsObject -Enabled $true -Category "allLogs"

        # Configure the diagnostic settings with the new log settings
        Set-AzDiagnosticSetting -ResourceId $keyVault.ResourceId -Name $diagnosticSettings.Name -Log $logSettings -Enabled $true

        # Add the key vault to the updated audit log settings array
        $updatedAuditLogSettingsKeyVaults += [PSCustomObject]@{
            KeyVaultName  = $keyVault.VaultName
            ResourceGroup = $keyVault.ResourceGroupName
            Subscription  = $subscription.Name
        }
    }
}

执行脚本时出现以下错误：

ARNING: Set-AzDiagnosticSetting is not found. The most similar Azure PowerShell commands are: Get-AzDiagnosticSetting New-AzDiagnosticSetting Set-AzDiagnosticSetting: The term 'Set-AzDiagnosticSetting' is not recognized as a name of a cmdlet, function, script file, or executable program

解决步骤 #

• 检查Az.Monitor模块版本：Set-AzDiagnosticSetting是Az.Monitor模块2.0.0及以上版本新增的命令，先确认已安装的模块版本：

  Get-InstalledModule -Name Az.Monitor
  

• 更新Az.Monitor模块：如果版本低于2.0.0，执行更新命令：

  Update-Module -Name Az.Monitor -Force
  

• 导入模块确保生效：更新完成后重新导入模块：

  Import-Module Az.Monitor -Force
  

• 替代方案：使用New-AzDiagnosticSetting覆盖设置：若无法更新模块，可使用New-AzDiagnosticSetting加-Force参数覆盖原有诊断设置，同时保留原有目标（如Log Analytics工作区、存储账户等），修改脚本中对应代码段：

  # 获取原有诊断设置的目标资源ID
  $existingWorkspace = $diagnosticSettings.WorkspaceId
  $existingStorage = $diagnosticSettings.StorageAccountId
  $existingEventHubRule = $diagnosticSettings.EventHubAuthorizationRuleId
  
  # 构建并应用新的诊断设置
  New-AzDiagnosticSetting -ResourceId $keyVault.ResourceId -Name $diagnosticSettings.Name `
    -Log $logSettings `
    -WorkspaceId $existingWorkspace `
    -StorageAccountId $existingStorage `
    -EventHubAuthorizationRuleId $existingEventHubRule `
    -Force
  

内容的提问来源于stack exchange，提问作者learner