azure-resource-diagnostics

azure-resource-diagnostics

Audits Azure diagnostic-settings coverage at a resource group scope.

When to use

• threadlight v0.5.x needs to flip OBS-106 from kind: manual to kind: sibling-skill — this skill's probe() is the sibling.
• Pre-pilot review: confirm a candidate Foundry RG routes its resource logs somewhere (Log Analytics / Event Hubs / Storage) before a customer pilot.
• Spoke landing-zone check: detect resources that have no diagnostic settings configured at all.

Probing an RG

from azure_resource_diagnostics.probe import probe

result = probe(
    subscription_id="<sub-id>",
    resource_group="<rg>",
    # target_resource_types=["storage_account", "key_vault"],  # optional OBS-106 filter
)
# result["resources"]                          → list of {id, name, type, configured, destinations, setting_count}
# result["summary"]["total_resources"]         → int (after type filter)
# result["summary"]["configured_count"]        → int (≥1 destination set)
# result["summary"]["unconfigured_count"]      → int (no destination)
# result["summary"]["target_resource_types_filter"] → list[str] | None (echo of applied filter)
# result["summary"]["confidence"]              → 0.0..1.0
# result["summary"]["probe_error"]             → str | None
# result["findings"]                           → list of no-diagnostic-settings findings
# result["manifest_path"]                      → path to JSON manifest on disk

target_resource_types (the OBS-106 sibling-contract input) is an optional list of resource-type tokens. Matching is robust: each token is normalized (lowercased, non-alphanumerics stripped) and matched as a substring of the normalized ARM type, so both raw ARM types (Microsoft.Storage/storageAccounts) and snake_case logical kinds (storage_account) select the same resources. When omitted (default), every resource in the RG is probed. The applied filter is echoed back in summary.target_resource_types_filter.

The probe never raises. If the RG resource listing is denied (RBAC missing), the probe still returns a shape with probe_error populated and confidence: 0.0. Resource types that don't support diagnostic settings (Monitor returns 404) are treated as having no destinations, not as a denial.