tylerjharden / terraform-azurerm-defender

terraform-azurerm-defender

With Secure Defaults from Checkov

Terraform module -

---

It's 100% Open Source and licensed under the APACHE2.

Usage

This is a very basic example.

From an original example: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/deploy-microsoft-defender-for-cloud-via-terraform/ba-p/3563710

Include module.acr.tf this repository as a module in your existing Terraform code:

module "search" {
  source      = "JamesWoolfenden/search/azurerm"
  version     = "v0.1.1"
  tags     = var.common_tags
  location = azurerm_resource_group.security_rg.location
  rg_name  = azurerm_resource_group.security_rg.name
  mdc_contact = {
    name                = "James Woolfenden"
    email               = "[e-mail]"
    phone               = var.phone
    alert_notifications = true
    alerts_to_admins    = true
  }
  pricing = [{
    resource_type = "VirtualMachines"
    tier          = "Standard"
    },
    {
      resource_type = "Arm"
      tier          = "Standard"
  }]
}

Requirements

No requirements.

Providers

Name	Version
azurerm	n/a

Modules

No modules.

Resources

Name	Type
azurerm_log_analytics_solution.la_workspace_security	resource
azurerm_log_analytics_solution.la_workspace_securityfree	resource
azurerm_log_analytics_workspace.la_workspace	resource
azurerm_role_assignment.va-auto-provisioning-identity-role	resource
azurerm_security_center_auto_provisioning.auto-provisioning	resource
azurerm_security_center_automation.la-exports	resource
azurerm_security_center_contact.mdc_contact	resource
azurerm_security_center_setting.setting_mcas	resource
azurerm_security_center_setting.setting_mde	resource
azurerm_security_center_setting.setting_sentinel	resource
azurerm_security_center_subscription_pricing.pike	resource
azurerm_security_center_workspace.la_workspace	resource
azurerm_subscription_policy_assignment.asb_assignment	resource
azurerm_subscription_policy_assignment.va-auto-provisioning	resource
azurerm_subscription.current	data source

Inputs

Name	Description	Type	Default	Required
MCAS_enabled	n/a	bool	false	no
SENTINEL_enabled	n/a	bool	false	no
WDATP_enabled	n/a	bool	true	no
location	n/a	string	n/a	yes
mdc_contact	n/a	object({ name = string email = string phone = string alert_notifications = bool alerts_to_admins = bool })	n/a	yes
pricing	n/a	list(object({ tier = string resource_type = string }))	n/a	yes
rg_name	n/a	string	n/a	yes
tags	This is to help you add tags to your cloud objects	map(any)	n/a	yes

Outputs

Name	Description
solutions	n/a
workspace	n/a

Policy

This is the policy required to build this project:

The Terraform resource required is:

resource "azurerm_role_definition" "terraform_pike" {
  role_definition_id = local.uuid
  name               = "terraform_pike"
  scope              = data.azurerm_subscription.primary.id

  permissions {
    actions = [
    "Microsoft.OperationalInsights/workspaces/delete",
    "Microsoft.OperationalInsights/workspaces/read",
    "Microsoft.OperationalInsights/workspaces/write",
    "Microsoft.Resources/subscriptions/providers/read"]
    not_actions = []
  }

  assignable_scopes = [
    data.azurerm_subscription.primary.id,
  ]
}

locals {
  uuid = uuid()
}

data "azurerm_subscription" "primary" {
}

Related Projects

Check out these related projects.

• terraform-aws-s3 - S3 buckets

Help

Got a question?

File a GitHub issue.

Contributing

Bug Reports & Feature Requests

Please use the issue tracker to report any bugs or file feature requests.

Copyrights

Copyright © 2022 James Woolfenden

License

See LICENSE for full details.

Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Contributors

James Woolfenden