Azure Monitor log profile does not capture all activities misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_38
Category - Subcategory	Logging - Disabled or missing
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	03a90ea7-d8f5-4761-beb7-ffcc24237741

Impact

A log profile controls how the activity log is exported. Configuring the log profile to collect logs for the categories Write, Delete and Action ensures that all control/management plane activities performed on the subscription are exported. We recommend you configure the log profile to export all activities from the control/management plane.

How to Fix

Resource: azurerm_monitor_log_profile

• Arguments: categories [source,go]

---

resource "azurerm_monitor_log_profile" "example" { ... categories = [

• "Action",
• "Delete",
• "Write", ] }

---