Azure Resource Diagnostics

azure-resource-diagnostics

Audits Azure diagnostic-settings coverage at a resource group scope.

When to use

• threadlight v0.5.x needs to flip OBS-106 from kind: manual to

kind: sibling-skill — this skill's probe() is the sibling.

• Pre-pilot review: confirm a candidate Foundry RG routes its resource

logs somewhere (Log Analytics / Event Hubs / Storage) before a customer pilot.

• Spoke landing-zone check: detect resources that have no diagnostic

settings configured at all.

Probing an RG

from azure_resource_diagnostics.probe import probe

result = probe(
    subscription_id="",
    resource_group="",
    # target_resource_types=["storage_account", "key_vault"],  # optional OBS-106 filter
)
# result["resources"]                          → list of {id, name, type, configured, destinations, setting_count}
# result["summary"]["total_resources"]         → int (after type filter)
# result["summary"]["configured_count"]        → int (≥1 destination set)
# result["summary"]["unconfigured_count"]      → int (no destination)
# result["summary"]["target_resource_types_filter"] → list[str] | None (echo of applied filter)
# result["summary"]["confidence"]              → 0.0..1.0
# result["summary"]["probe_error"]             → str | None
# result["findings"]                           → list of no-diagnostic-settings findings
# result["manifest_path"]                      → path to JSON manifest on disk

target_resource_types (the OBS-106 sibling-contract input) is an optional list of resource-type tokens. Matching is robust: each token is normalized (lowercased, non-alphanumerics stripped) and matched as a substring of the normalized ARM type, so both raw ARM types (Microsoft.Storage/storageAccounts) and snake_case logical kinds (storage_account) select the same resources. When omitted (default), every resource in the RG is probed. The applied filter is echoed back in summary.target_resource_types_filter.

The probe never raises. If the RG resource listing is denied (RBAC missing), the probe still returns a shape with probe_error populated and confidence: 0.0. Resource types that don't support diagnostic settings (Monitor returns 404) are treated as having no destinations, not as a denial.

> MUST: Copy verbatim from > [references/python/probe.py](references/python/probe.py). > Do NOT redefine inline — the validator enforces single-source-of-truth.

"Any destination counts" (decision)

Per spec §4.4 Q-D2 (locked decision), a resource is configured if it has any diagnostic setting routing to any destination:

| Destination | Setting attribute | Meaning | |-------------|-------------------|---------| | Log Analytics | workspace_id | Logs → LAW workspace | | Event Hubs | event_hub_authorization_rule_id | Logs → Event Hubs | | Storage | storage_account_id | Logs → Storage account |

A diagnostic setting that exists but routes nowhere counts as unconfigured. Each unconfigured resource produces a no-diagnostic-settings finding.

CLI

python -m azure_resource_diagnostics --sub  --rg 
# optional OBS-106 type filter (ARM types or logical kinds):
python -m azure_resource_diagnostics --sub  --rg  --target-resource-types storage_account key_vault

Outputs JSON to stdout AND writes the same content to out/.json. Override via AZURE_RESOURCE_DIAGNOSTICS_OUT=.

Auth

Uses DefaultAzureCredential. Caller needs at minimum Monitoring Reader at the RG scope (built-in role) plus Reader to list resources. Without it, the probe returns a shape with probe_error populated rather than raising.

See also

• azure-backup-readiness — peer skill for backup-coverage audit.
• azure-monitor-alert-baseline — peer skill for alert coverage audit.
• foundry-rbac-audit — peer skill for RBAC posture audit.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: aiappsgbb
• Source: aiappsgbb/awesome-gbb
• License: MIT

Install and usage instructions live in the source repository linked above.