New policy: Configure private DNS Zones for an Azure Data Explorer cluster groupID

[erwinkramer]

Configure private DNS Zones for an Azure Data Explorer cluster groupID

This is one of those special private endpoints that require a registration in multiple private DNS zones just for one PE (4 in this case), similarly to Configure Azure Monitor Private Link Scope to use private DNS zones (that one has 5).

There exists just one subresource for Microsoft.Kusto/Clusters, but i implemented a policyRule on the combination of privateLinkServiceId and groupIds, so if there will be another subresource implemented for kusto, this policy won't collide.

I copied the wording and style from configure-a-private-dns-zone-id-for-cognitive-services-account-groupid.

I ran it through the Confirm-PolicyDefinitionIsValid.ps1 without issues and formatted via Out-FormattedPolicyDefinition.ps1.

If you want to verify this policy yourself in your own environment, you can take the Private Endpoint as Bicep, as specified at erwinkramer/kusto-event-hub-law, or just deploy that whole solution. Or you can use the azure-quickstart-template and only implement the PE.

After PR merge

1. Should be a built-in one @ https://github.com/Azure/azure-policy , because the generic Configure a private DNS Zone ID for file groupID isn't suitable for multiple zone registrations for one PE. Let me know if you want me to post an 'idea' into Azure feedback as suggested in the readme here after completion.

2. Include in Enterprise Scale - Deploy-Private-DNS-Zones set definition, that definition already has a azureDataExplorerPrivateDnsZoneId value added for dnsZoneNames, but no policy is using that value yet. Could be the one in this PR. I can suggest a PR for that repo, after the policy is promoted to built-in. Let me know if you like that.