Azure Blame

GetAzureResourceLog.ps1

<#
.SYNOPSIS
Gets focused Az log information on resources. Helpful to determine who created what.

.DESCRIPTION
Providing only the ResourceGroupName will retrive logs for all items in that resource group. You can additionall filter the operations. If you also provide the resource name and type then only logs for that single items will be retrieved

.PARAMETER ResourceGroupName
Specifies the name of the resource group.

.PARAMETER ResourceName
Specifies the name of the single resource.

.PARAMETER ResourceType
Specifies the type of the single resource.

.PARAMETER MatchOperations
Specifies a regex pattern of operation names to filter for.
#>
[CmdletBinding(DefaultParameterSetName='Group')]
param(
    [Parameter(ParameterSetName='Group', Mandatory)]
    [Parameter(ParameterSetName='SingleItem', Mandatory)]
    $ResourceGroupName,

    [Parameter(ParameterSetName='SingleItem', Mandatory)]
    $ResourceName,

    [Parameter(ParameterSetName='SingleItem', Mandatory)]
    $ResourceType,

    $FilterOperations
)

$context = Get-AzContext
if(-not $context) {
    Write-Warning 'Connect to your Azure account with Connect-AzAccount'
}

$logs = $null

if($PSCmdlet.ParameterSetName -eq 'SingleItem') {
    $resource = Get-AzResource -ResourceGroupName $ResourceGroupName -Name $ResourceName -ResourceType $ResourceType
    $logs = Get-AzLog -ResourceId $resource.Id
} elseif ($PSCmdlet.ParameterSetName -eq 'Group') {
    $logs = Get-AzLog -ResourceGroupName $ResourceGroupName
}

$parameters = @{
    Property = @(
        'Caller',
        @{Name='Operation'; Expression = { $_.OperationName.LocalizedValue}},
        'ResourceId',
        @{Name='ResourceName'; Expression = { $_.Authorization.Scope | Split-Path -Leaf }}
    )
}

if($FilterOperations) {
    $logs | Where-Object { $_.OperationName.LocalizedValue -match $FilterOperations -or $_.OperationName.Value -match $FilterOperations } | Select-Object @parameters
} else {
    $logs | Select-Object @parameters
}