Can you link a log analytic workspace to a dedicated cluster by a policy?

Question

We want to deploy a dedicated cluster and enforce people to be linked to this cluster with their LAW automatically. Is this possible to be done by a policy?
Or is there a better "best practise" way of (automatically) linking workspaces to a dedicated cluster in Azure?

Answer 1

Hi Hoeneveld, T.A. (Tim),

Thanks for reaching out to Microsoft Q&A.

it's possible to manage the linkage between a log analytics workspace and a dedicated cluster, but the process of automatically enforcing this linkage through an azure policy is not directly available as a built-in solution. However, there are several best practices and automation techniques you can use to achieve this goal.

####Option 1: Azure Policy with Deployment Automation####

You can create a custom azure policy that audits whether a log analytics workspace is linked to a particular cluster and enforces it via automated remediation. Here's how you can structure the solution:

1. Custom Azure Policy Definition:
   • Create a custom Azure Policy that audits log analytics workspace settings and checks if it’s linked to a specific cluster.
   • If it's not linked, the policy can trigger a remediation task to associate the workspace with the dedicated cluster.
2. Azure Automation for Remediation:
   • Set up an azure automation runbook that is triggered by the azure policy to automatically link the workspace to the cluster.
   • This could involve executing a powerShell or CLI script that configures the link between LAW and the dedicated cluster.
   Deploy the Policy:
   • Assign the policy at the subscription or resource group level to ensure that any new or existing LAW is checked and linked to the cluster.

####Option 2: ARM Template or Terraform with Policy####

You can deploy a dedicated cluster and associated Log Analytics Workspace together using IAC (ARM templates, Bicep, or Terraform). Then, enforce this deployment model via policy. The steps include:

Deploy the Cluster and LAW Together:

• In the deployment template, include configurations that automatically link the LAW to the cluster.
  • This ensures that every time a cluster is deployed, it is linked with a LAW.
  Enforce with Azure Policy:

  - Azure Policy can enforce that deployments follow the template structure, ensuring LAW is always associated with the dedicated cluster.
  

Best Practices for Linking LAW to a Dedicated Cluster

• Centralized Monitoring: Use a central log analytics workspace and link it to the dedicated cluster across your environment. This simplifies the management and visibility of logs and telemetry data.
• Automation: Utilize azure automation or azure functions to enforce workspace-to-cluster linkage after creation automatically.
• Policy Enforcement: Use azure policy to audit and enforce the correct association, especially when there are multiple environments or teams involved.

Please 'Upvote'(Thumbs-up) and 'Accept' as an answer if the reply was helpful. This will benefit other community members who face the same issue.