Enable Diagnostic Logs for Container Apps Environments

Risk Level: Medium (should be achieved)

To collect detailed information on resource operations, ensure that Diagnostic Logs are enabled for your Microsoft Azure Container Apps environments. Diagnostic Logs provide detailed insights into operations, helps identify and resolve issues quickly, ensures compliance with governance policies, and supports auditing and analysis of resource usage and performance.

Security

Reliability

Operational
excellence

Cost
optimisation

Performance
efficiency

By default, Diagnostic Logs are not enabled for your Azure Container Apps environments. Without Diagnostic Logs, the visibility into your Azure data plane is greatly reduced. This diminishes your organization's ability to detect potential attacks, unauthorized requests, or other malicious activity. Once collected, Diagnostic Logs should be sent to a storage account and a Log Analytics Workspace or an equivalent third-party system. The log files should be kept in readily accessible storage for at least one year, and then moved to inexpensive cold storage for a longer duration (required for security and compliance auditing).

Audit

To determine if Diagnostic Logs are enabled for your Azure Container Apps environments, perform the following operations:

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

04 From the Type equalls all filter box, choose Equals, select Container Apps Environment, and choose Apply to list only the Azure Container Apps environments available in the selected subscription.

05 Click on the name (link) of the Azure Container Apps environment that you want to examine.

06 In the resource navigation panel, under Monitoring, select Diagnostic settings. If Diagnostic settings is not available in the navigation panel, the selected Container Apps environment is not configured to save logs, therefore, Diagnostic Logs are not enabled for the Azure Container Apps associated with the selected environment.

07 On the Diagnostic settings page, check for any diagnostic settings created for your environment. If there are no diagnostic settings available, the Diagnostic Logs monitoring feature is not enabled for the selected Azure Container Apps environment. If one or more diagnostic settings were created for your environment, choose the diagnostic setting that you want to examine, and select Edit settings. Check the Categories list under Logs to determine the logging configuration available for your environment. Repeat this step for each diagnostic setting created for the selected environment. If one or more log categories are not selected, Diagnostic Logs are not enabled for the Azure Container Apps associated with the selected environment.

08 Repeat steps no. 5 - 7 for each Azure Container Apps environment available within the selected subscription.

09 Repeat steps no. 3 – 8 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run containerapp env list command (Windows/macOS/Linux) with custom query filters to list the identifier (ID) of each Azure Container Apps environment available in the selected subscription:

az containerapp env list
	--query '[*].id'

05 The command output should return the requested Container Apps environment IDs:

[
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.App/managedEnvironments/managedEnvironment-project5-app-abcd",
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.App/managedEnvironments/managedEnvironment-container-app-bcda"
]

06 Run monitor diagnostic-settings list command (Windows/macOS/Linux) with the ID of the Azure Container Apps environment that you want to examine as the identifier parameter and custom output filters to describe the name of each diagnostics setting configured for the selected environment:

az monitor diagnostic-settings list
	--resource "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.App/managedEnvironments/managedEnvironment-project5-app-abcd"
	--query '[].name'

07 The command output should return the requested diagnostics setting identifiers (names). If the command output returns an empty array, i.e. [], there are no diagnostic settings configured for the selected Azure Container Apps environment or the environment is not configured to save logs, therefore, the Audit process ends here. Otherwise, you can continue the Audit process with the next step:

[
	"tm-main-app-diagnostic-logs",
	"tm-custom-app-diagnostic-logs"
]

08 Run monitor diagnostic-settings show command (Windows/macOS/Linux) with the name of the diagnostic setting that you want to examine as the identifier parameter, to describe the log categories supported by Azure Container Apps, configured for the selected diagnostic setting:

az monitor diagnostic-settings show
	--name "tm-main-app-diagnostic-logs"
	--resource "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.App/managedEnvironments/managedEnvironment-project5-app-abcd"
	--query 'logs'

09 The command output should return the supported log categories and their status:

[
	{
		"category": "ContainerAppConsoleLogs",
		"enabled": false,
		"retentionPolicy": {
			"days": 0,
			"enabled": false
		}
	},
	{
		"category": "ContainerAppSystemLogs",
		"enabled": false,
		"retentionPolicy": {
			"days": 0,
			"enabled": false
		}
	},
	{
		"category": "AppEnvSpringAppConsoleLogs",
		"enabled": false,
		"retentionPolicy": {
			"days": 0,
			"enabled": false
		}
	}
]

Check the "enabled" attribute value for each log category supported by Azure Container Apps to determine the logging configuration for the selected diagnostic setting. If one or more log categories are disabled (i.e. "enabled": false), the selected diagnostic setting is not properly configured to collect diagnostic logs.

10 Repeat steps no. 8 and 9 for each diagnostic setting created for the selected Azure Container Apps environment. If none of the diagnostic settings are properly configured, the Diagnostic Logs monitoring feature is not enabled for the Azure Container Apps associated with the selected environment.

11 Repeat step no. 6 - 10 for each Azure Container Apps environment available in the selected Azure subscription.

12 Repeat steps no. 3 – 11 for each subscription created in your Microsoft Azure cloud account.

Remediation / Resolution

To enable and configure Diagnostic Logs for your Azure Container Apps environments, perform the following operations:

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

05 Click on the name (link) of the Azure Container Apps environment that you want to configure.

06 In the resource navigation panel, under Monitoring, select Diagnostic settings. If Diagnostic settings is not available in the navigation panel, choose Logging options under Monitoring, set Logs Destination to Azure Monitor: View, analyze, and act on log data. If selected, you'll route logs to one or more destinations in Diagnostic settings, and choose Save to apply the changes.

07 On the Diagnostic settings page, choose Add diagnostic setting to create a new diagnostic setting. Resource logs won't be collected or stored until you create a diagnostic setting and direct them to one or more locations. A diagnostic setting specifies a list of log categories and/or metrics that you want to collect from an Azure cloud resource, and one or more destinations that you would stream them to.

08 On the Diagnostic setting setup page, perform the following actions:

Provide a unique name for your new diagnostic setting in the Diagnostic setting name box.
In the Logs section, check the allLogs setting checkbox to select all the log categories supported by Azure Container Apps.
(Optional) In the Metrics section, check the AllMetrics setting checkbox if you want to route the resource's platform metrics to the selected log destinations. By default, platform metrics are sent automatically to Azure Monitor Metrics without any additional configuration required.
In the Destination details section, configure one or more log destinations based on your application requirements:
1. Select Send to Log Analytics workspace and choose a workspace from the Log Analytics workspace dropdown list to send the diagnostic logs.
2. Select Archive to a storage account and choose a storage account from the Storage account dropdown list to archive the collected logs for at least one year (recommended). The storage account needs to be in the same region as the resource being monitored if the resource is regional.
3. Select Stream to an event hub to stream the collected logs to an Event Hub. Select the name, namespace, and policy of the event hub that you want to use.
4. Select Send to partner solution to deliver the log files to a supported third-party system. For supported partner integrations, please refer to this page.
Choose Save to apply the configuration changes.

09 Repeat steps no. 5 – 8 for each Azure Container Apps environment available within the selected subscription.

10 Repeat steps no. 3 – 9 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run monitor diagnostic-settings create command (Windows/macOS/Linux) to create a new diagnostic setting for the specified Azure Container Apps environment in order to enable the Diagnostic Logs monitoring feature. As an example, the following command request creates a diagnostic setting named "tm-new-app-diagnostic-logs" for a Container Apps environment specified by --resource, that collects and sends all the supported diagnostic logs to a Log Analytics workspace identified by the ID "abcd1234abcd1234abcd1234" and archive the files to an Azure Storage account identified by "abcd1234abcd1234abcd1234". Platform metrics are sent automatically to Azure Monitor Metrics by default and without any configuration. If you need to route the resource's platform metrics to the selected log destinations, include the --metrics parameter in the command request, as shown in the example below:

az monitor diagnostic-settings create
	--name "tm-new-app-diagnostic-logs"
	--resource "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.App/managedEnvironments/managedEnvironment-project5-app-abcd"
	--workspace "abcd1234abcd1234abcd1234"
	--storage-account "1234abcd1234abcd1234"
	--logs '[
			{
				"categoryGroup": "allLogs",
				"enabled": true,
				"retentionPolicy": {
					"days": 0,
					"enabled": false
				}
			},
			{
				"categoryGroup": "audit",
				"enabled": false,
				"retentionPolicy": {
					"days": 0,
					"enabled": false
				}
			}
	]'
	--metrics '[
		{
			"category": "AllMetrics",
			"enabled": true,
			"retentionPolicy": {
				"enabled": true,
				"days": 0
			}
		}
	]'

05 The command output should return the information available for the new diagnostic setting:

{
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourcegroups/cloud-shell-storage-westeurope/providers/microsoft.app/managedenvironments/managedEnvironment-project5-app-abcd/providers/microsoft.insights/diagnosticSettings/tm-new-app-diagnostic-logs",
	"logs": [
		{
			"categoryGroup": "allLogs",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		},
		{
			"categoryGroup": "audit",
			"enabled": false,
			"retentionPolicy": {
				"days": 0,
				"enabled": false
			}
		}
	],
	"metrics": [
		{
			"category": "AllMetrics",
			"enabled": true,
			"retentionPolicy": {
				"days": 0,
				"enabled": true
			},
			"timeGrain": "PT1M"
		}
	],
	"name": "tm-new-app-diagnostic-logs",
	"resourceGroup": "cloud-shell-storage-westeurope",
	"storageAccountId": "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.Storage/storageAccounts/1234abcd1234abcd1234",
	"type": "Microsoft.Insights/diagnosticSettings",
	"workspaceId": "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.OperationalInsights/workspaces/abcd1234abcd1234abcd1234"
}

06 Repeat steps no. 4 and 5 for each Azure Container Apps environment provisioned in the selected subscription.

07 Repeat steps no. 3 – 6 for each subscription created within your Microsoft Azure cloud account.

References

Azure Official Documentation
Log storage and monitoring options in Azure Container Apps
Diagnostic settings in Azure Monitor

Azure Command Line Interface (CLI) Documentation
az account list
az account set
az containerapp env list
az monitor diagnostic-settings list
az monitor diagnostic-settings show
az monitor diagnostic-settings create

Publication date Nov 20, 2024

Audit

Using Azure Console

Using Azure CLI

Remediation / Resolution

Using Azure Console

Using Azure CLI

References

Related ContainerApps rules