Feature Request: Log Analytic instances in multiple regions

[giovannifl-wpp]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Is your feature request related to a problem? I have the requirement to use multiple Azure regions ( i.e. UK South and UK West) and they may be deployed under the same MG structure. This is means that in the Management Zone at least two Log Analytic instances should be deployed ( as per Microsoft Best Practices), one for UK West and one for UK South. Currently ESLZ (Enterprise Scale Landing Zone) approach, forces all Azure resources, deployed in ANY regions to send their logs into the "only" Log Analytic that exists in the Management Zone.

Describe the solution you'd like Extend Management Zone to support the concept of "Regions": a user can provide a list of Azure regions (as a parameter) for the Management Zone and ESLZ Terraform module will take care of:

• Deploy a Log Analytic instance in each region provide by the user
• Configure Azure policy so that Azure resources will send their logs to the "regional" Log Analytic ( A custom policy will be required for this )

Additional context

[krowlandson]

Thank you for logging this request.

Because this module is designed around the recommended ALZ architecture and design patterns, we only support a central Log Analytics workspace. However you can technically deploy only the management resources by setting deploy_core_landing_zones = false along with deploy_management_resources = true and using default_location (or the location settings within configure_management_resources) to target the desired location.

This would give you a consistent approach for deployment, and you could even standardise the configure_management_resources input when inheriting location from the default_location input variable.

However, as you rightly identify you would need to develop and deploy custom policies to ensure logs of each type are sent to the desired target Log Analytics workspace.

Another reason beyond our ALZ recommendations as to why we haven't developed this as a feature is because there are also variations on how this can be implemented depending on how an organisation operates. Some go for a Log Analytics workspace per location, whilst others align to larger geographical regions such as Americas, EMEA, and APAC. These variations would each require different solutions.

We also differentiate between logs for the platform (centralised) and then have guidance which allows for dedicated Log Analytics workspace(s) per application or application stack for APM. The former is what we're concerned by with ALZ, whilst the latter is operated by the individual application teams based on their requirements.

Happy to further consider and discuss your scenario, but hope this additional context helps.

[matt-FFFFFF]

Hi @giovannifl-wpp

Thank you for your feedback request.

This module is an implementation of the ALZ conceptual architecture, and the log analytics (Azure monitor logs) workspace recommendation is to have a single workspace.

Logging centralization drives reports about change management, service health, configuration, and most other aspects of IT operations. Focusing on a centralized workspace model reduces administrative effort and the chances for gaps in observability.

https://docs.microsoft.com/en-gb/azure/cloud-adoption-framework/ready/landing-zone/design-area/management-platform#inventory-and-visibility-recommendations

You are able to deploy multiple workspaces outside the context of this module. You may wish to consider the effect of this on the DeployIfNotExists policies that are used, adding a customization for resource location.

You can use multiple instances of this module to deploy management resources to multiple locations should this be of use.

[krowlandson]

• Linking this issue to #392 as this will make it easier to understand how to implement just the Management resources at different scopes
• Worth noting that at this point there is no intention of updating the policies needed for this scenario as it doesn't align to the ALZ recommended approach of a centralized Log Analytics workspace

[jtracey93]

Trigger ADO Sync

[AlexcFrench]

Thank you very much for the feedback and explanation. We'll investigate further.

[krowlandson]

Trigger ADO Sync

[matt-FFFFFF]

We are leaving this open for tracking and are discussing all up ALZ architecture for this request

[matt-FFFFFF]

AB#23916

[matt-FFFFFF]

Unplanned