To automate deployments in Azure while supporting parameters, versioning, and source control, you should use Azure DevOps with Bicep or Azure Resource Manager (ARM) templates as your infrastructure-as-code (IaC) tools. Azure DevOps provides a CI/CD platform, while Bicep or ARM templates define the infrastructure.
Reference:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/overview

Explanation:
Box 1: Azure Automation Change Tracking
Changes to the Windows registry on the virtual machines
Change Tracking and Inventory in Azure Automation
This feature tracks changes in virtual machines hosted in Azure, on-premises, and other cloud environments to help you pinpoint operational and environmental issues with software managed by the Distribution Package Manager. Items that are tracked by Change Tracking and Inventory include:
Windows software
Linux software (packages)
Windows and Linux files
*-> Windows registry keys
Windows services
Linux daemons
Box 2: Azure Monitor for VM Insights
Changes to the DNS settings of the virtual machines
VM insights provides a quick and easy method for getting started monitoring the client workloads on your virtual machines and virtual machine scale sets. It displays an inventory of your existing VMs and provides a guided experience to enable base monitoring for them.
Reference:
https://learn.microsoft.com/en-us/azure/automation/change-tracking/overview
https://learn.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-overview
https://learn.microsoft.com/en-us/azure/azure-monitor/change/change-analysis

Explanation:
Box 1: Azure Application Gateway
Uses Azure Web Application Firewall (WAF) to minimize the risk of a web-based attack against App1 The Azure Web Application Firewall (WAF) on Azure Application Gateway actively safeguards your web applications against common exploits and vulnerabilities. As web applications become more frequent targets for malicious attacks, these attacks often exploit well-known vulnerabilities such as SQL injection and cross-site scripting.
WAF on Application Gateway is based on the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP).
All of the following WAF features exist inside of a WAF policy. You can create multiple policies, and they can be associated with an Application Gateway, to individual listeners, or to path-based routing rules on an Application Gateway. This way, you can have separate policies for each site behind your Application Gateway if needed.
Box 2: Azure Bastion
Ensures that administrators can access VM1 and VM2 securely from the internet Protect your virtual machines with more secure remote access Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.
Box 3: Azure Private Link
Ensures that traffic from App1 to DB1 is NOT sent via the internet
* Azure Private Link
Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.
Traffic between your virtual network and the service travels the Microsoft backbone network.
Exposing your service to the public internet is no longer necessary. You can create your own private link service in your virtual network and deliver it to your customers. Setup and consumption using Azure Private Link is consistent across Azure PaaS, customer-owned, and shared partner services.
Reference:
https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
https://azure.microsoft.com/en-us/products/azure-bastion
https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint
https://learn.microsoft.com/en-us/azure/app-service/overview-security
https://learn.microsoft.com/en-us/azure/private-link/private-link-overview

Instead of creating a private link for each resource the virtual network connects to, Azure Monitor uses a single private link connection using a private endpoint from the virtual network to an Azure Monitor Private Link Scope (AMPLS). The AMPLS is a set of Azure Monitor resources that define the boundaries of your monitoring network.

Resource-specific endpoints
Log Analytics endpoints are workspace specific, except for the query endpoint. As a result, adding a specific Log Analytics workspace to the AMPLS will send ingestion requests to this workspace over the private link. Ingestion to other workspaces will continue to use the public endpoints.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security