Automation Runbook should enable verbose logging

Medium Azure General runbooks-diagnostics

Applies to

Microsoft.Automation/automationAccounts/runbooks

What CGPulse checks

A resource passes this rule when logVerbose must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable logging to capture audit and operational events for investigation. In Azure Portal: Automation Account > Runbooks > select runbook > enable logging. See: https://learn.microsoft.com/en-us/azure/automation/automation-runbook-output-and-messages

CLI

az automation runbook update --ids "{id}" --log-verbose true

Bicep

resource automationAccount 'Microsoft.Automation/automationAccounts@2023-11-01' existing = {{
  name: '{parentName}'
}}
resource runbook 'Microsoft.Automation/automationAccounts/runbooks@2023-11-01' = {{
  parent: automationAccount
  name: '{name}'
  location: location
  properties: {{
    runbookType: 'PowerShell'
    logVerbose: true
    logProgress: true
  }}
}}

Terraform

resource "azurerm_automation_runbook" "{name}" {
  name                    = "{name}"
  resource_group_name     = "{rg}"
  location                = var.location
  automation_account_name = "<automation-account-name>"
  runbook_type            = "PowerShell"
  log_verbose             = true
  log_progress            = true

  content = "# Runbook content"
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan