enable traffic analytics and bump network flow logs to v2

src/core/saca-hub/main.tf

@@ -92,7 +92,7 @@ module "saca-firewall" {
   management_ipconfig_name        = var.management_ipconfig_name
   management_publicip_name        = var.management_publicip_name
 
-  log_analytics_workspace_id = module.saca-hub-network.log_analytics_workspace_id
+  log_analytics_workspace_resource_id = module.saca-hub-network.log_analytics_workspace_resource_id
 
   tags = {
     DeploymentName = var.deploymentname
@@ -137,8 +137,10 @@ module "jumpbox-subnet" {
   routetable_name     = var.jumpbox_subnet.routetable_name
   firewall_ip_address = module.saca-firewall.firewall_public_ip
 
-  log_analytics_storage_id   = module.saca-hub-network.log_analytics_storage_id
-  log_analytics_workspace_id = module.saca-hub-network.log_analytics_workspace_id
+  log_analytics_storage_id            = module.saca-hub-network.log_analytics_storage_id
+  log_analytics_workspace_id          = module.saca-hub-network.log_analytics_workspace_id
+  log_analytics_workspace_location    = module.saca-hub-network.log_analytics_workspace_location
+  log_analytics_workspace_resource_id = module.saca-hub-network.log_analytics_workspace_resource_id
 
   tags = {
     DeploymentName = var.deploymentname

src/core/tier-0/main.tf

@@ -74,13 +74,13 @@ resource "azurerm_resource_group" "t0" {
 }
 
 module "t0-network" {
-  depends_on                 = [azurerm_resource_group.t0, data.azurerm_log_analytics_workspace.hub]
-  source                     = "../../modules/virtual-network"
-  location                   = azurerm_resource_group.t0.location
-  resource_group_name        = azurerm_resource_group.t0.name
-  vnet_name                  = var.tier0_vnetname
-  vnet_address_space         = var.tier0_vnet_address_space
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  depends_on                          = [azurerm_resource_group.t0, data.azurerm_log_analytics_workspace.hub]
+  source                              = "../../modules/virtual-network"
+  location                            = azurerm_resource_group.t0.location
+  resource_group_name                 = azurerm_resource_group.t0.name
+  vnet_name                           = var.tier0_vnetname
+  vnet_address_space                  = var.tier0_vnet_address_space
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname
@@ -108,8 +108,10 @@ module "t0-subnets" {
   routetable_name     = each.value.routetable_name
   firewall_ip_address = data.azurerm_firewall.firewall.ip_configuration[0].private_ip_address
 
-  log_analytics_storage_id   = module.t0-network.log_analytics_storage_id
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  log_analytics_storage_id            = module.t0-network.log_analytics_storage_id
+  log_analytics_workspace_id          = data.azurerm_log_analytics_workspace.hub.workspace_id
+  log_analytics_workspace_location    = data.azurerm_log_analytics_workspace.hub.location
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname

src/core/tier-1/main.tf

@@ -74,13 +74,13 @@ resource "azurerm_resource_group" "t1" {
 }
 
 module "t1-network" {
-  depends_on                 = [azurerm_resource_group.t1, data.azurerm_log_analytics_workspace.hub]
-  source                     = "../../modules/virtual-network"
-  location                   = azurerm_resource_group.t1.location
-  resource_group_name        = azurerm_resource_group.t1.name
-  vnet_name                  = var.tier1_vnetname
-  vnet_address_space         = var.tier1_vnet_address_space
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  depends_on                          = [azurerm_resource_group.t1, data.azurerm_log_analytics_workspace.hub]
+  source                              = "../../modules/virtual-network"
+  location                            = azurerm_resource_group.t1.location
+  resource_group_name                 = azurerm_resource_group.t1.name
+  vnet_name                           = var.tier1_vnetname
+  vnet_address_space                  = var.tier1_vnet_address_space
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname
@@ -108,8 +108,10 @@ module "t1-subnets" {
   routetable_name     = each.value.routetable_name
   firewall_ip_address = data.azurerm_firewall.firewall.ip_configuration[0].private_ip_address
 
-  log_analytics_storage_id   = module.t1-network.log_analytics_storage_id
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  log_analytics_storage_id            = module.t1-network.log_analytics_storage_id
+  log_analytics_workspace_id          = data.azurerm_log_analytics_workspace.hub.workspace_id
+  log_analytics_workspace_location    = data.azurerm_log_analytics_workspace.hub.location
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname

src/core/tier-2/main.tf

@@ -74,13 +74,13 @@ resource "azurerm_resource_group" "t2" {
 }
 
 module "t2-network" {
-  depends_on                 = [azurerm_resource_group.t2, data.azurerm_log_analytics_workspace.hub]
-  source                     = "../../modules/virtual-network"
-  location                   = azurerm_resource_group.t2.location
-  resource_group_name        = azurerm_resource_group.t2.name
-  vnet_name                  = var.tier2_vnetname
-  vnet_address_space         = var.tier2_vnet_address_space
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  depends_on                          = [azurerm_resource_group.t2, data.azurerm_log_analytics_workspace.hub]
+  source                              = "../../modules/virtual-network"
+  location                            = azurerm_resource_group.t2.location
+  resource_group_name                 = azurerm_resource_group.t2.name
+  vnet_name                           = var.tier2_vnetname
+  vnet_address_space                  = var.tier2_vnet_address_space
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname
@@ -108,8 +108,10 @@ module "t2-subnets" {
   routetable_name     = each.value.routetable_name
   firewall_ip_address = data.azurerm_firewall.firewall.ip_configuration[0].private_ip_address
 
-  log_analytics_storage_id   = module.t2-network.log_analytics_storage_id
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  log_analytics_storage_id            = module.t2-network.log_analytics_storage_id
+  log_analytics_workspace_id          = data.azurerm_log_analytics_workspace.hub.workspace_id
+  log_analytics_workspace_location    = data.azurerm_log_analytics_workspace.hub.location
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname

src/core/tier-3/main.tf

@@ -74,13 +74,13 @@ resource "azurerm_resource_group" "t3" {
 }
 
 module "t3-network" {
-  depends_on                 = [azurerm_resource_group.t3, data.azurerm_log_analytics_workspace.hub]
-  source                     = "../../modules/virtual-network"
-  location                   = azurerm_resource_group.t3.location
-  resource_group_name        = azurerm_resource_group.t3.name
-  vnet_name                  = var.tier3_vnetname
-  vnet_address_space         = var.tier3_vnet_address_space
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  depends_on                          = [azurerm_resource_group.t3, data.azurerm_log_analytics_workspace.hub]
+  source                              = "../../modules/virtual-network"
+  location                            = azurerm_resource_group.t3.location
+  resource_group_name                 = azurerm_resource_group.t3.name
+  vnet_name                           = var.tier3_vnetname
+  vnet_address_space                  = var.tier3_vnet_address_space
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname
@@ -108,8 +108,10 @@ module "t3-subnets" {
   routetable_name     = each.value.routetable_name
   firewall_ip_address = data.azurerm_firewall.firewall.ip_configuration[0].private_ip_address
 
-  log_analytics_storage_id   = module.t3-network.log_analytics_storage_id
-  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.hub.id
+  log_analytics_storage_id            = module.t3-network.log_analytics_storage_id
+  log_analytics_workspace_id          = data.azurerm_log_analytics_workspace.hub.workspace_id
+  log_analytics_workspace_location    = data.azurerm_log_analytics_workspace.hub.location
+  log_analytics_workspace_resource_id = data.azurerm_log_analytics_workspace.hub.id
 
   tags = {
     DeploymentName = var.deploymentname

src/modules/firewall/main.tf

@@ -93,7 +93,7 @@ resource "azurerm_monitor_diagnostic_setting" "firewall-diagnostics" {
   name                       = "${azurerm_firewall.firewall.name}-fw-diagnostics"
   target_resource_id         = azurerm_firewall.firewall.id
   storage_account_id         = azurerm_storage_account.loganalytics.id
-  log_analytics_workspace_id = var.log_analytics_workspace_id
+  log_analytics_workspace_id = var.log_analytics_workspace_resource_id
 
   dynamic "log" {
     for_each = local.firewall_log_categories
@@ -119,7 +119,7 @@ resource "azurerm_monitor_diagnostic_setting" "publicip-diagnostics" {
   name                       = "${azurerm_public_ip.fw_client_pip.name}-pip-diagnostics"
   target_resource_id         = azurerm_public_ip.fw_client_pip.id
   storage_account_id         = azurerm_storage_account.loganalytics.id
-  log_analytics_workspace_id = var.log_analytics_workspace_id
+  log_analytics_workspace_id = var.log_analytics_workspace_resource_id
 
   dynamic "log" {
     for_each = local.public_ip_log_categories

src/modules/firewall/variables.tf

@@ -56,8 +56,8 @@ variable "management_publicip_name" {
   description = "The name of the Firewall Management Public IP"
 }
 
-variable "log_analytics_workspace_id" {
-  description = "The id of the Log Analytics Workspace"
+variable "log_analytics_workspace_resource_id" {
+  description = "The resource id of the Log Analytics Workspace"
 }
 
 variable "tags" {
@@ -66,8 +66,8 @@ variable "tags" {
   default     = {}
 }
 
-# With forced tunneling on, Configure Azure Firewall to never SNAT regardless of the destination IP address, 
-# use 0.0.0.0/0 as your private IP address range. 
+# With forced tunneling on, Configure Azure Firewall to never SNAT regardless of the destination IP address,
+# use 0.0.0.0/0 as your private IP address range.
 # With this configuration, Azure Firewall can never route traffic directly to the Internet.
 # see: https://docs.microsoft.com/en-us/azure/firewall/snat-private-range
 variable "disable_snat_ip_range" {

src/modules/hub/main.tf

@@ -4,14 +4,23 @@ data "azurerm_resource_group" "rg" {
   name = var.resource_group_name
 }
 
+resource "azurerm_log_analytics_workspace" "loganalytics" {
+  name                = var.log_analytics_workspace_name
+  resource_group_name = data.azurerm_resource_group.rg.name
+  location            = data.azurerm_resource_group.rg.location
+  sku                 = var.log_analytics_workspace_sku
+  retention_in_days   = var.log_analytics_workspace_retention_in_days
+  tags                = var.tags
+}
+
 module "hub-network" {
-  source                     = "../virtual-network"
-  location                   = data.azurerm_resource_group.rg.location
-  resource_group_name        = data.azurerm_resource_group.rg.name
-  vnet_name                  = var.vnet_name
-  vnet_address_space         = var.vnet_address_space
-  log_analytics_workspace_id = azurerm_log_analytics_workspace.loganalytics.id
-  tags                       = var.tags
+  source                              = "../virtual-network"
+  location                            = data.azurerm_resource_group.rg.location
+  resource_group_name                 = data.azurerm_resource_group.rg.name
+  vnet_name                           = var.vnet_name
+  vnet_address_space                  = var.vnet_address_space
+  log_analytics_workspace_resource_id = azurerm_log_analytics_workspace.loganalytics.id
+  tags                                = var.tags
 }
 
 resource "azurerm_subnet" "fw_client" {
@@ -59,12 +68,3 @@ resource "azurerm_subnet_route_table_association" "routetable" {
     time_sleep.wait_30_seconds
   ]
 }
-
-resource "azurerm_log_analytics_workspace" "loganalytics" {
-  name                = var.log_analytics_workspace_name
-  resource_group_name = data.azurerm_resource_group.rg.name
-  location            = data.azurerm_resource_group.rg.location
-  sku                 = var.log_analytics_workspace_sku
-  retention_in_days   = var.log_analytics_workspace_retention_in_days
-  tags                = var.tags
-}

src/modules/hub/output.tf

@@ -41,6 +41,14 @@ output "log_analytics_workspace_name" {
 }
 
 output "log_analytics_workspace_id" {
+  value = azurerm_log_analytics_workspace.loganalytics.workspace_id
+}
+
+output "log_analytics_workspace_location" {
+  value = data.azurerm_resource_group.rg.location
+}
+
+output "log_analytics_workspace_resource_id" {
   value = azurerm_log_analytics_workspace.loganalytics.id
 }
 

src/modules/subnet/main.tf

@@ -71,7 +71,7 @@ resource "azurerm_monitor_diagnostic_setting" "nsg" {
   name                       = "${azurerm_network_security_group.nsg.name}-nsg-diagnostics"
   target_resource_id         = azurerm_network_security_group.nsg.id
   storage_account_id         = var.log_analytics_storage_id
-  log_analytics_workspace_id = var.log_analytics_workspace_id
+  log_analytics_workspace_id = var.log_analytics_workspace_resource_id
 
   dynamic "log" {
     for_each = local.nsg_log_categories
@@ -93,9 +93,18 @@ resource "azurerm_network_watcher_flow_log" "nsgfl" {
   network_security_group_id = azurerm_network_security_group.nsg.id
   storage_account_id        = var.log_analytics_storage_id
   enabled                   = true
+  version                   = 2
 
   retention_policy {
     enabled = true
     days    = var.flow_log_retention_in_days
   }
+
+  traffic_analytics {
+    enabled               = true
+    workspace_id          = var.log_analytics_workspace_id
+    workspace_region      = var.log_analytics_workspace_location
+    workspace_resource_id = var.log_analytics_workspace_resource_id
+    interval_in_minutes   = 10
+  }
 }

src/modules/subnet/variables.tf

@@ -71,6 +71,14 @@ variable "log_analytics_workspace_id" {
   description = "The id of the log analytics workspace"
 }
 
+variable "log_analytics_workspace_location" {
+  description = "The location of the log analytics workspace"
+}
+
+variable "log_analytics_workspace_resource_id" {
+  description = "The resource id of the log analytics workspace"
+}
+
 variable "flow_log_retention_in_days" {
   description = "The number of days to retain flow log data"
   default     = "7"

src/modules/virtual-network/main.tf

@@ -31,7 +31,7 @@ resource "azurerm_monitor_diagnostic_setting" "vnet" {
   name                       = "${var.vnet_name}-vn-diagnostics"
   target_resource_id         = azurerm_virtual_network.vnet.id
   storage_account_id         = azurerm_storage_account.loganalytics.id
-  log_analytics_workspace_id = var.log_analytics_workspace_id
+  log_analytics_workspace_id = var.log_analytics_workspace_resource_id
 
   metric {
     category = "AllMetrics"

src/modules/virtual-network/variables.tf

@@ -16,7 +16,7 @@ variable "vnet_address_space" {
   description = "The address space to be used for the virtual network"
 }
 
-variable "log_analytics_workspace_id" {
+variable "log_analytics_workspace_resource_id" {
   description = "The resource ID of the Log Analytics Workspace to log events from the virtual network"
 }