Microsoft Defender for Cloud

Azure module to deploy a Microsoft Defender for Cloud.

⚠️ NOTE:

Owner access permission is required.

Global versioning rule for Claranet Azure modules

Module version	Terraform version	OpenTofu version	AzureRM version
>= 8.x.x	Unverified	1.8.x	>= 4.0
>= 7.x.x	1.3.x		>= 3.0
>= 6.x.x	1.x		>= 3.0
>= 5.x.x	0.15.x		>= 2.0
>= 4.x.x	0.13.x / 0.14.x		>= 2.0
>= 3.x.x	0.12.x		>= 2.0
>= 2.x.x	0.12.x		< 2.0
< 2.x.x	0.11.x		< 2.0

Contributing

If you want to contribute to this repository, feel free to use our pre-commit git hook configuration which will help you automatically update and format some files for you by enforcing our Terraform code module best-practices.

More details are available in the CONTRIBUTING.md file.

Usage

This module is optimized to work with the Claranet terraform-wrapper tool which set some terraform variables in the environment needed by this module. More details about variables set by the terraform-wrapper available in the documentation.

⚠️ Since modules version v8.0.0, we do not maintain/check anymore the compatibility with Hashicorp Terraform. Instead, we recommend to use OpenTofu.

module "defender_for_cloud" {
  source  = "claranet/defender-for-cloud/azurerm"
  version = "x.x.x"
}

Providers

Name	Version
azapi	~> 2.3
azurerm	~> 4.31

Modules

No modules.

Resources

Name	Type
azapi_resource.container_pricing	resource
azurerm_security_center_contact.main	resource
azurerm_security_center_subscription_pricing.cloud_posture	resource
azurerm_security_center_subscription_pricing.cosmosdbs	resource
azurerm_security_center_subscription_pricing.main	resource
azurerm_security_center_subscription_pricing.opensourcerelationaldatabases	resource
azurerm_security_center_subscription_pricing.sqlservers	resource
azurerm_security_center_subscription_pricing.sqlservers_vms	resource
azurerm_client_config.current	data source

Inputs

Name	Description	Type	Default	Required
alert_notifications_enabled	Whether to send security alerts notifications to the security contact or not.	bool	true	no
alerts_to_admins_enabled	Whether to send security alerts notifications to Subscription admins (Owners) or not.	bool	true	no
contact	The name, email and phone number to contact for security alerts.	object({ name = optional(string) email = optional(string) phone = optional(string) })	{}	no
enable_agentless_discovery_for_kubernetes	Enable agentless discovery for Kubernetes extension in Defender for Cloud.	bool	true	no
enable_agentless_vm_scanning	Enable agentless VM scanning extension in Defender for Cloud.	bool	true	no
enable_container_integrity_contribution	Enable container integrity contribution extension in Defender for Cloud.	bool	true	no
enable_container_pricing	Enable container pricing in Defender for Cloud.	bool	true	no
enable_container_registries_vulnerability_assessments	Enable container registries vulnerability assessments extension in Defender for Cloud.	bool	true	no
enable_container_sensor	Enable container sensor extension in Defender for Cloud.	bool	true	no
enable_cosmosdbs_pricing	Enable Cosmos DBs pricing in Defender for Cloud.	bool	true	no
enable_opensourcerelationaldatabases_pricing	Enable open source relational databases pricing in Defender for Cloud.	bool	true	no
enable_sqlservers_pricing	Enable SQL servers pricing in Defender for Cloud.	bool	true	no
enable_sqlservers_vms_pricing	Enable SQL servers VMs pricing in Defender for Cloud.	bool	true	no
exclusion_tags	List of VM tags to exclude from Agentless scanning Defender for Cloud.	list(object({ key = string value = string }))	[]	no
services	Defender for Cloud services list to activate. See https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/security_center_subscription_pricing.	list(object({ resource_type = string tier = optional(string, "Standard") subplan = optional(string, null) }))	[ { "resource_type": "AppServices" }, { "resource_type": "Arm", "subplan": "PerSubscription" }, { "resource_type": "KeyVaults", "subplan": "PerKeyVault" }, { "resource_type": "StorageAccounts", "subplan": "DefenderForStorageV2" }, { "resource_type": "VirtualMachines", "subplan": "P1" } ]	no

Outputs

Name	Description
alert_contact_id	The alert contact object ID.
resource_alert_contact	The alert contact object.
resource_subscribed_plans	List of subscribed plans and services.

Related documentation

Microsoft Azure documentation: xxxx