Skip to content

Commit b4005c8

Browse files
ttorblettorble
authored
Merge pull request #250093 from DevOpsStyle/AMA-agent-policy-arm
update with ARM
2 parents faa79e4 + 2ad98a8 commit b4005c8

File tree

1 file changed

+169
-2
lines changed

1 file changed

+169
-2
lines changed

‎articles/azure-monitor/agents/azure-monitor-agent-data-collection-endpoint.md

Lines changed: 169 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Azure Monitor Agent supports connecting by using direct proxies, Log Analytics g
1515

1616
Azure Monitor Agent supports [Azure virtual network service tags](../../virtual-network/service-tags-overview.md). Both *AzureMonitor* and *AzureResourceManager* tags are required.
1717

18-
Azure Virtual network service tags can be used to define network access controls on [network security groups](../../virtual-network/network-security-groups-overview.md#security-rules), [Azure Firewall](../../firewall/service-tags.md), and user-defined routes. Use service tags in place of specific IP addresses when you create security rules and routes. For scenarios where Azure virtual network service tags can not be used, the Firewall requirements are given below.
18+
Azure Virtual network service tags can be used to define network access controls on [network security groups](../../virtual-network/network-security-groups-overview.md#security-rules), [Azure Firewall](../../firewall/service-tags.md), and user-defined routes. Use service tags in place of specific IP addresses when you create security rules and routes. For scenarios where Azure virtual network service tags cannot be used, the Firewall requirements are given below.
1919

2020
## Firewall requirements
2121

@@ -47,7 +47,7 @@ The Azure Monitor Agent extensions for Windows and Linux can communicate either
4747
![Diagram that shows a flowchart to determine the values of settings and protectedSettings parameters when you enable the extension.](media/azure-monitor-agent-overview/proxy-flowchart.png)
4848

4949
> [!NOTE]
50-
> Setting Linux system proxy via environment variables such as `http_proxy` and `https_proxy` is only supported using Azure Monitor Agent for Linux version 1.24.2 and above.
50+
> Setting Linux system proxy via environment variables such as `http_proxy` and `https_proxy` is only supported using Azure Monitor Agent for Linux version 1.24.2 and above. For the ARM template, if you have proxy configuration please follow the ARM template example below declaring the proxy setting inside the ARM template.
5151
5252
1. After you determine the `Settings` and `ProtectedSettings` parameter values, provide these other parameters when you deploy Azure Monitor Agent. Use PowerShell commands, as shown in the following examples:
5353

@@ -85,6 +85,173 @@ $protectedSettings = @{"proxy" = @{username = "[username]"; password = "[passwor
8585
New-AzConnectedMachineExtension -Name AzureMonitorLinuxAgent -ExtensionType AzureMonitorLinuxAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName <resource-group-name> -MachineName <arc-server-name> -Location <arc-server-location> -Setting $settings -ProtectedSetting $protectedSettings
8686
```
8787

88+
# [ARM Policy Template example](#tab/ArmPolicy)
89+
90+
```powershell
91+
{
92+
"properties": {
93+
"displayName": "Configure Windows Arc-enabled machines to run Azure Monitor Agent",
94+
"policyType": "BuiltIn",
95+
"mode": "Indexed",
96+
"description": "Automate the deployment of Azure Monitor Agent extension on your Windows Arc-enabled machines for collecting telemetry data from the guest OS. This policy will install the extension if the OS and region are supported and system-assigned managed identity is enabled, and skip install otherwise. Learn more: https://aka.ms/AMAOverview.",
97+
"metadata": {
98+
"version": "2.3.0",
99+
"category": "Monitoring"
100+
},
101+
"parameters": {
102+
"effect": {
103+
"type": "String",
104+
"metadata": {
105+
"displayName": "Effect",
106+
"description": "Enable or disable the execution of the policy."
107+
},
108+
"allowedValues": [
109+
"DeployIfNotExists",
110+
"Disabled"
111+
],
112+
"defaultValue": "DeployIfNotExists"
113+
}
114+
},
115+
"policyRule": {
116+
"if": {
117+
"allOf": [
118+
{
119+
"field": "type",
120+
"equals": "Microsoft.HybridCompute/machines"
121+
},
122+
{
123+
"field": "Microsoft.HybridCompute/machines/osName",
124+
"equals": "Windows"
125+
},
126+
{
127+
"field": "location",
128+
"in": [
129+
"australiacentral",
130+
"australiaeast",
131+
"australiasoutheast",
132+
"brazilsouth",
133+
"canadacentral",
134+
"canadaeast",
135+
"centralindia",
136+
"centralus",
137+
"eastasia",
138+
"eastus",
139+
"eastus2",
140+
"eastus2euap",
141+
"francecentral",
142+
"germanywestcentral",
143+
"japaneast",
144+
"japanwest",
145+
"jioindiawest",
146+
"koreacentral",
147+
"koreasouth",
148+
"northcentralus",
149+
"northeurope",
150+
"norwayeast",
151+
"southafricanorth",
152+
"southcentralus",
153+
"southeastasia",
154+
"southindia",
155+
"swedencentral",
156+
"switzerlandnorth",
157+
"uaenorth",
158+
"uksouth",
159+
"ukwest",
160+
"westcentralus",
161+
"westeurope",
162+
"westindia",
163+
"westus",
164+
"westus2",
165+
"westus3"
166+
]
167+
}
168+
]
169+
},
170+
"then": {
171+
"effect": "[parameters('effect')]",
172+
"details": {
173+
"type": "Microsoft.HybridCompute/machines/extensions",
174+
"roleDefinitionIds": [
175+
"/providers/Microsoft.Authorization/roleDefinitions/cd570a14-e51a-42ad-bac8-bafd67325302"
176+
],
177+
"existenceCondition": {
178+
"allOf": [
179+
{
180+
"field": "Microsoft.HybridCompute/machines/extensions/type",
181+
"equals": "AzureMonitorWindowsAgent"
182+
},
183+
{
184+
"field": "Microsoft.HybridCompute/machines/extensions/publisher",
185+
"equals": "Microsoft.Azure.Monitor"
186+
},
187+
{
188+
"field": "Microsoft.HybridCompute/machines/extensions/provisioningState",
189+
"equals": "Succeeded"
190+
}
191+
]
192+
},
193+
"deployment": {
194+
"properties": {
195+
"mode": "incremental",
196+
"template": {
197+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
198+
"contentVersion": "1.0.0.0",
199+
"parameters": {
200+
"vmName": {
201+
"type": "string"
202+
},
203+
"location": {
204+
"type": "string"
205+
}
206+
},
207+
"variables": {
208+
"extensionName": "AzureMonitorWindowsAgent",
209+
"extensionPublisher": "Microsoft.Azure.Monitor",
210+
"extensionType": "AzureMonitorWindowsAgent"
211+
},
212+
"resources": [
213+
{
214+
"name": "[concat(parameters('vmName'), '/', variables('extensionName'))]",
215+
"type": "Microsoft.HybridCompute/machines/extensions",
216+
"location": "[parameters('location')]",
217+
"apiVersion": "2021-05-20",
218+
"properties": {
219+
"publisher": "[variables('extensionPublisher')]",
220+
"type": "[variables('extensionType')]",
221+
"autoUpgradeMinorVersion": true,
222+
"enableAutomaticUpgrade": true,
223+
"settings": {
224+
"proxy": {
225+
"auth": "false",
226+
"mode": "application",
227+
"address": "http://XXX.XXX.XXX.XXX"
228+
}
229+
},
230+
"protectedsettings": { }
231+
}
232+
}
233+
]
234+
},
235+
"parameters": {
236+
"vmName": {
237+
"value": "[field('name')]"
238+
},
239+
"location": {
240+
"value": "[field('location')]"
241+
}
242+
}
243+
}
244+
}
245+
}
246+
}
247+
}
248+
},
249+
"id": "/providers/Microsoft.Authorization/policyDefinitions/94f686d6-9a24-4e19-91f1-de937dc171a4",
250+
"type": "Microsoft.Authorization/policyDefinitions",
251+
"name": "94f686d6-9a24-4e19-91f1-de937dc171a4"
252+
}
253+
```
254+
88255
---
89256

90257
## Log Analytics gateway configuration

0 commit comments

Comments
 (0)