Adding Hybrid alerts

patterns/alz/policyAssignments/DINE-HybridVMAssignment.json

@@ -0,0 +1,85 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "topLevelManagementGroupPrefix": {
+      "type": "string",
+      "metadata": {
+        "description": "Provide the ESLZ prefix to your intermediate root management group containing the policy definitions."
+      }
+    },
+    "enforcementMode": {
+      "type": "string",
+      "allowedValues": [ "Default", "DoNotEnforce" ],
+      "defaultValue": "Default"
+    },
+    "nonComplianceMessagePlaceholder": {
+      "type": "string",
+      "defaultValue": "{enforcementMode}"
+    },
+    "policyAssignmentParameters": {
+      "type": "object",
+      "defaultValue": {}
+    }
+  },
+  "variables": {
+    "policyDefinitions": {
+      "deployAMBAHybridVM": "[concat('/providers/Microsoft.Management/managementGroups/', parameters('topLevelManagementGroupPrefix'), '/providers/Microsoft.Authorization/policySetDefinitions/Alerting-HybridVM')]"
+    },
+    "policyAssignmentNames": {
+      "ambaHybridVM": "Deploy-AMBA-HybridVM",
+      "description": "Initiative to deploy AMBA Hybrid VM alerts",
+      "displayName": "Deploy Azure Monitor Baseline Alerts for Hybrid VMs"
+    },
+    "nonComplianceMessage": {
+      "message": "Alerting {enforcementMode} be deployed to Azure services.",
+      "Default": "must",
+      "DoNotEnforce": "should"
+    },
+    "rbacContributor": "b24988ac-6180-42a0-ab88-20f7382dd24c",
+    "roleAssignmentNames": {
+      "deployAMBAHybridVM": "[guid(concat(parameters('topLevelManagementGroupPrefix'), variables('policyAssignmentNames').ambaHybridVM))]"
+    }
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Authorization/policyAssignments",
+      "apiVersion": "2020-09-01",
+      "name": "[variables('policyAssignmentNames').ambaHybridVM]",
+      "location": "[deployment().location]",
+      "identity": {
+        "type": "SystemAssigned"
+      },
+      "properties": {
+        "description": "[variables('policyAssignmentNames').description]",
+        "displayName": "[variables('policyAssignmentNames').displayName]",
+        "policyDefinitionId": "[variables('policyDefinitions').deployAMBAHybridVM]",
+        "enforcementMode": "[parameters('enforcementMode')]",
+        "nonComplianceMessages": [
+          {
+            "message": "[replace(variables('nonComplianceMessage').message, parameters('nonComplianceMessagePlaceholder'), variables('nonComplianceMessage')[parameters('enforcementMode')])]"
+          }
+        ],
+        "parameters": "[parameters('policyAssignmentParameters')]",
+        "metadata": {
+          "_deployed_by_amba": true
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2022-04-01",
+      "name": "[variables('roleAssignmentNames').deployAMBAHybridVM]",
+      "dependsOn": [
+        "[variables('policyAssignmentNames').ambaHybridVM]"
+      ],
+      "properties": {
+        "principalType": "ServicePrincipal",
+        "roleDefinitionId": "[concat('/providers/Microsoft.Authorization/roleDefinitions/', variables('rbacContributor'))]",
+        "principalId": "[toLower(reference(concat('/providers/Microsoft.Authorization/policyAssignments/', variables('policyAssignmentNames').ambaHybridVM), '2019-09-01', 'Full' ).identity.principalId)]",
+        "description": "_deployed_by_amba"
+      }
+    }
+  ],
+  "outputs": {}
+}