如何使用ARM模板为AKS节点资源组的NSG和VMSS启用审计诊断设置

你可以通过以下方式改造ARM模板，为AKS节点资源组内的NSG、VMSS资源配置完全一致的审计诊断设置： #

核心思路 #

1. 不用硬编码AKS节点资源组名称，直接通过ARM的reference函数读取已部署AKS的nodeResourceGroup属性，获取动态生成的节点资源组名
2. 分别为NSG、VMSS两类资源定义诊断设置规则，用copy循环适配同类型的多个资源
3. 所有配置项和你之前的AKS诊断规则完全对齐：全量日志+全量指标采集，保留30天，关联同一个存储账户

完整ARM模板片段（可直接追加到你原有的resources数组中） #

注：已修正你原有代码里的拼写错误clutername为clustername

"variables": {
  "aksNodeRGName": "[reference(resourceId('Microsoft.ContainerService/managedClusters', parameters('clustername')), '2023-02-01').nodeResourceGroup]",
  "storageAccountId": "[parameters('storageAccountId')]",
  "retentionDays": 30
},
"resources": [
  // 你原有的AKS诊断设置资源保留即可，这里追加下面两类资源
  // 1. 节点资源组内所有NSG的诊断设置
  {
    "condition": "[parameters('audit_enable')]",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2021-04-01",
    "name": "deploy-nsg-diagnostics",
    "resourceGroup": "[variables('aksNodeRGName')]",
    "dependsOn": [
      "[resourceId('Microsoft.ContainerService/managedClusters', parameters('clustername'))]"
    ],
    "properties": {
      "mode": "Incremental",
      "template": {
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "resources": [
          {
            "type": "Microsoft.Network/networkSecurityGroups/providers/diagnosticSettings",
            "apiVersion": "2021-05-01-preview",
            "name": "[concat(parameters('nsgNames')[copyIndex()], '/Microsoft.Insights/default')]",
            "copy": {
              "name": "nsgDiagnosticsCopy",
              "count": "[length(parameters('nsgNames'))]"
            },
            "properties": {
              "storageAccountId": "[variables('storageAccountId')]",
              "logs": [
                {
                  "categoryGroup": "allLogs",
                  "enabled": true,
                  "retentionPolicy": {
                    "days": "[variables('retentionDays')]",
                    "enabled": true
                  }
                }
              ],
              "metrics": [
                {
                  "category": "AllMetrics",
                  "enabled": true,
                  "retentionPolicy": {
                    "days": "[variables('retentionDays')]",
                    "enabled": true
                  }
                }
              ]
            }
          }
        ]
      }
    }
  },
  // 2. 节点资源组内所有VMSS的诊断设置
  {
    "condition": "[parameters('audit_enable')]",
    "type": "Microsoft.Resources/deployments",
    "apiVersion": "2021-04-01",
    "name": "deploy-vmss-diagnostics",
    "resourceGroup": "[variables('aksNodeRGName')]",
    "dependsOn": [
      "[resourceId('Microsoft.ContainerService/managedClusters', parameters('clustername'))]"
    ],
    "properties": {
      "mode": "Incremental",
      "template": {
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "resources": [
          {
            "type": "Microsoft.Compute/virtualMachineScaleSets/providers/diagnosticSettings",
            "apiVersion": "2021-05-01-preview",
            "name": "[concat(parameters('vmssNames')[copyIndex()], '/Microsoft.Insights/default')]",
            "copy": {
              "name": "vmssDiagnosticsCopy",
              "count": "[length(parameters('vmssNames'))]"
            },
            "properties": {
              "storageAccountId": "[variables('storageAccountId')]",
              "logs": [
                {
                  "categoryGroup": "allLogs",
                  "enabled": true,
                  "retentionPolicy": {
                    "days": "[variables('retentionDays')]",
                    "enabled": true
                  }
                }
              ],
              "metrics": [
                {
                  "category": "AllMetrics",
                  "enabled": true,
                  "retentionPolicy": {
                    "days": "[variables('retentionDays')]",
                    "enabled": true
                  }
                }
              ]
            }
          }
        ]
      }
    }
  }
]

补充说明 #

• 你需要提前在参数里定义nsgNames和vmssNames两个数组参数，传入节点资源组内对应的NSG、VMSS资源名称；如果需要动态获取资源列表，可以配合Azure PowerShell/Azure CLI在部署前扫描节点资源组的对应资源作为参数传入
• 模板使用了跨资源组部署的方式，因此需要确保执行部署的服务主体/账号对AKS节点资源组有写入权限
• 如果需要适配节点资源组内的其他资源类型，只需要仿照上面的结构修改资源type和name字段即可

内容的提问来源于stack exchange，提问作者Rajesh174u