Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enable Resource Logs

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: APIManagement-005

Ensure that your Azure API Management API services are configured to use resource logs in order to collect valuable information on API Management operations and errors. By enabling resource logs through a diagnostic setting, you can gather extensive information on the API requests received and handled by the Azure API Management service gateway.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security
Operational
excellence

Enabling resource logs (Azure Monitor logs) for Azure API Management services provides a wealth of insights into API operations and errors, enhancing troubleshooting, auditing, and performance monitoring capabilities. This enables administrators to proactively identify and resolve issues promptly, improve API performance, and gain valuable insights into API usage patterns.


Audit

To determine if resource logs are enabled for Azure API Management API services, perform the following actions:

Using Azure Console

01 Sign in to the Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#view/HubsExtension/BrowseAll to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription filter box and choose Apply.

04 From the Type filter box, select API Management service and choose Apply to list only the Microsoft Azure API Management services available in the selected subscription.

05 Click on the name (link) of the Azure API Management service that you want to examine.

06 In the navigation panel, under Monitoring, select Diagnostic settings. Diagnostic settings are used to configure the streaming export of the logs and metrics to the destination of your choice.

07 Check for any diagnostic settings configured for your API service, listed in the Diagnostic settings list. If there are no diagnostic settings listed in this section and the following message is displayed: No diagnostic settings defined, resource logs are not being exported for the selected Azure API Management service instance.

08 Repeat steps no. 5 – 7 for each Azure API Management service available in the selected Azure subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run apim list command (Windows/macOS/Linux) using custom query filters to list the name and the associated resource group for each Azure API Management service instance available in the current subscription:

az apim list
  --output table
  --query '[*].{name:name, resourceGroup:resourceGroup}'

02 The command output should return the requested Azure API Management service names:

Name                           ResourceGroup
----------------------         ------------------------------
cc-main-api-service-instance   cloud-shell-storage-westeurope
cc-project5-service-instance   cloud-shell-storage-westeurope

03 Run monitor diagnostic-settings list command (Windows/macOS/Linux) with custom query filters to list the names of the diagnostic settings created and configured for the selected Azure API Management service:

az monitor diagnostic-settings list
  --resource cc-main-api-service-instance
  --resource-group cloud-shell-storage-westeurope
  --resource-type "Microsoft.ApiManagement/service"
  --query '[*].name'

04 The command output should return the identifier (name) of each diagnostic setting defined for the selected resource:

[]

If the monitor diagnostic-settings list command output returns an empty array (i.e. []), as shown in the output example above, there are no diagnostic settings configured to export resource logs for the selected Azure API Management service instance.

05 Repeat steps no. 3 and 4 for each Azure API Management service available within the current Azure subscription.

06 Repeat steps no. 1 – 5 for each subscription created in your Microsoft Azure cloud account.

Remediation / Resolution

To ensure that resource logs are enabled for your Azure API Management API services, perform the following actions:

Using Azure Console

01 Sign in to the Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#view/HubsExtension/BrowseAll to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription filter box and choose Apply.

04 From the Type filter box, select API Management service and choose Apply to list only the Microsoft Azure API Management services available in the selected subscription.

05 Click on the name (link) of the Azure API Management service that you want to configure.

06 In the navigation panel, under Monitoring, select Diagnostic settings. Diagnostic settings are used to configure the streaming export of the logs and metrics to the destination of your choice.

07 Choose + Add diagnostic setting to create a new diagnostic setting for the selected resource.

08 On the Diagnostic setting setup page, perform the following operations:

  1. Provide a unique name for your new diagnostic setting in the Diagnostic setting name box.
  2. For Logs, choose the log categories that you want to collect from the selected resource, available in the Categories section. You can also choose to enable one or more log category groups from the Category groups section.
  3. For Destination details, select one of the following options or multiple options, based on your application requirements:
    • Select Send to Log Analytics workspace and choose the subscription and the Log Analytics workspace that you want to use to collect your logging data. For Destination table select which table resource data is stored in.
    • Select Archive to a storage account if you want to write the logs to an Azure storage account. Choose the Azure subscription and the storage account that will store your log data.
    • Select Stream to an event hub if you want to write the resource logs to an Azure Event Hub. Choose the subscription and the event hub namespace in which you would like an event hub to be created for streaming your logging data.
    • Select Send to partner solution for partner integration. You must first install partner integration into your Azure subscription. Configuration options vary by partner.
  4. Choose Save to apply the changes. Logs are streamed to the specified destination(s) as new event data is generated.

09 Repeat steps no. 5 – 8 for each Azure API Management service that you want to configure, available in the selected Azure subscription.

10 Repeat steps no. 3 – 9 for each subscription created within your Microsoft Azure cloud account.

Using Azure CLI

01 Run monitor diagnostic-settings create command (Windows/macOS/Linux) to create a new diagnostic setting for your Azure API Management service instance, in order to send resource logs to a Log Analytics workspace, a storage account, a partner solution, and/or to an Azure Event Hub. For example, the following command request creates a diagnostic setting that writes your API Management resource logs (i.e. API Management gateway and WebSocket connection logs) to an Azure storage account identified by the ID "/subscriptions/abcdabcd-abcd-abcd-abcd-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.Storage/storageAccounts/abcdabcdabcdabcdabcdabcd":

az monitor diagnostic-settings create
  --resource cc-main-api-service-instance
  --resource-group cloud-shell-storage-westeurope
  --resource-type "Microsoft.ApiManagement/service"
  --name cc-api-resource-diagnostic-setting
  --storage-account "/subscriptions/abcdabcd-abcd-abcd-abcd-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.Storage/storageAccounts/abcdabcdabcdabcdabcdabcd"
  --logs '[
	{
		"category": "GatewayLogs",
		"enabled": true
	},
	{
		"category": "WebSocketConnectionLogs",
		"enabled": true
	}
]'

02 The command output should return the configuration information available for the new diagnostic setting:

{
	"id": "/subscriptions/abcdabcd-abcd-abcd-abcd-abcdabcdabcd/resourcegroups/cloud-shell-storage-westeurope/providers/microsoft.apimanagement/service/cc-main-api-service-instance/providers/microsoft.insights/diagnosticSettings/cc-api-resource-diagnostic-setting",
	"logs": [
		{
			"category": "GatewayLogs",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		},
		{
			"category": "WebSocketConnectionLogs",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		}
	],
	"metrics": [],
	"name": "cc-api-resource-diagnostic-setting",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"storageAccountId": "/subscriptions/abcdabcd-abcd-abcd-abcd-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.Storage/storageAccounts/abcdabcdabcdabcdabcdabcd",
	"type": "Microsoft.Insights/diagnosticSettings"
  }

03 Repeat steps no. 1 and 2 for each Azure API Management service that you want to configure, available within the current subscription.

04 Repeat steps no. 1 - 3 for each subscription created in your Microsoft Azure cloud account.

References

Publication date Dec 26, 2023