MLZ: Add diagnostic setting for Bastion

[brooke-hamilton]

Benefit/Result/Outcome

So that an IT Admin can view audit logs and metrics from the Log Analytics workspace and have the data archived in storage to improve SCCA compliance.

Description

Azure Bastion can have a diagnostic setting added similar to other diagnostic settings created by MLZ.

Acceptance Criteria

A diagnostic setting is deployed with Azure Bastion that has the following properties:

• "BastionAuditLogs" are collected
• "AllMetrics" are collected
• "Send to Log Analytics Workspace" is selected and the MLZ operations tier workspace is specified.
• "Archive to a storage account" is selected and the storage account for logs in the hub resource group is specified.

See Also

https://docs.microsoft.com/en-us/azure/bastion/diagnostic-logs

[lisamurphy-msft]

Wondering why this is not specifying adding the logs to a Log Analytics Workspace, which is deployed with MissionLZ. Having a more centralized location for audit logs is more ideal.
Also not seeing a clear path forward on using the Microsoft.Network/bastionHosts documentation on how to enable this programmatically through bicep

[ruandersMSFT]

Configuration is completed by using Microsoft.Insights/diagnosticSettings as a scoped extension to the Bastion Resource.