MIT License
-> NOTE: When running the module, your subscription should not already be onboarded to MDC. If you have already completed the onboarding process, please refer to the Onboarded Azure Subscription section.
~> NOTE: Deletion of the resource will reset the pricing tier to Free
Please be aware that major version(e.g., from 1.0.0 to 2.0.0) update contains breaking changes that may impact your infrastructure. It is crucial to review these changes with caution before proceeding with the upgrade.
In most cases, you will need to adjust your Terraform code to accommodate the changes introduced in the new major version. We strongly recommend reviewing the changelog and migration guide to understand the modifications and ensure a smooth transition.
To help you in this process, we have provided detailed documentation on the breaking changes, new features, and any deprecated functionalities. Please take the time to read through these resources to avoid any potential issues or disruptions to your infrastructure.
Remember, upgrading to a major version with breaking changes should be done carefully and thoroughly tested in your environment. If you have any questions or concerns, please don't hesitate to reach out to our support team for assistance.
This Terraform module activate Microsoft Defender for Cloud (MDC) plans.
The module supports the following onboarding types:
Terraform core's version is v1.x and terraform-provider-azurerm's version is v3.x.
To enable plans using this module, follow these steps based on the subscription type:
examples\single_subscription
folder.terraform apply
command.examples
based on your scenario.terraform apply
command.output
will be generated within the example folder.output
folder.main.tf
file within this folder to align with your specific requirements.terraform apply
command again to apply your modifications.terraform destroy
command.terraform apply
command.We recommend managing the entire onboarding process with our module. If you've already onboarded your Azure Subscription to Microsoft Defender for Cloud plans, you have several options:
This module uses terraform-provider-modtm to collect telemetry data. This provider is designed to assist with tracking the usage of Terraform modules. It creates a custom modtm_telemetry
resource that gathers and sends telemetry data to a specified endpoint. The aim is to provide visibility into the lifecycle of your Terraform modules - whether they are being created, updated, or deleted. This data can be invaluable in understanding the usage patterns of your modules, identifying popular modules, and recognizing those that are no longer in use.
The ModTM provider is designed with respect for data privacy and control. The only data collected and transmitted are the tags you define in module's modtm_telemetry
resource, an uuid which represents a module instance's identifier, and the operation the module's caller is executing (Create/Update/Delete/Read). No other data from your Terraform modules or your environment is collected or transmitted.
One of the primary design principles of the ModTM provider is its non-blocking nature. The provider is designed to work in a way that any network disconnectedness or errors during the telemetry data sending process will not cause a Terraform error or interrupt your Terraform operations. This makes the ModTM provider safe to use even in network-restricted or air-gaped environments.
If the telemetry data cannot be sent due to network issues, the failure will be logged, but it will not affect the Terraform operation in progress(it might delay your operations for no more than 5 seconds). This ensures that your Terraform operations always run smoothly and without interruptions, regardless of the network conditions.
You can turn off the telemetry collection by declaring the following provider
block in your root module:
provider "modtm" {
enabled = false
}
We assumed that you have setup service principal's credentials in your environment variables like below:
export ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
export ARM_TENANT_ID="<azure_subscription_tenant_id>"
export ARM_CLIENT_ID="<service_principal_appid>"
export ARM_CLIENT_SECRET="<service_principal_password>"
On Windows Powershell:
$env:ARM_SUBSCRIPTION_ID="<azure_subscription_id>"
$env:ARM_TENANT_ID="<azure_subscription_tenant_id>"
$env:ARM_CLIENT_ID="<service_principal_appid>"
$env:ARM_CLIENT_SECRET="<service_principal_password>"
We provide a docker image to run the pre-commit checks and tests for you: mcr.microsoft.com/azterraform:latest
To run the pre-commit task, we can run the following command:
$ docker run --rm -v $(pwd):/src -w /src mcr.microsoft.com/azterraform:latest make pre-commit
On Windows Powershell:
$ docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest make pre-commit
In pre-commit task, we will:
terraform fmt -recursive
command for your Terraform code.terrafmt fmt -f
command for markdown files and go code files to ensure that the Terraform code embedded in these files are well formatted.go mod tidy
and go mod vendor
for test folder to ensure that all the dependencies have been synced.gofmt
for all go code files.gofumpt
for all go code files.terraform-docs
on README.md
file, then run markdown-table-formatter
to format markdown tables in README.md
.Then we can run the pr-check task to check whether our code meets our pipeline's requirement (We strongly recommend you run the following command before you commit):
$ docker run --rm -v $(pwd):/src -w /src mcr.microsoft.com/azterraform:latest make pr-check
On Windows Powershell:
$ docker run --rm -v ${pwd}:/src -w /src mcr.microsoft.com/azterraform:latest make pr-check
To run the e2e-test, we can run the following command:
docker run --rm -v $(pwd):/src -w /src -e ARM_SUBSCRIPTION_ID -e ARM_TENANT_ID -e ARM_CLIENT_ID -e ARM_CLIENT_SECRET mcr.microsoft.com/azterraform:latest make e2e-test
On Windows Powershell:
docker run --rm -v ${pwd}:/src -w /src -e ARM_SUBSCRIPTION_ID -e ARM_TENANT_ID -e ARM_CLIENT_ID -e ARM_CLIENT_SECRET mcr.microsoft.com/azterraform:latest make e2e-test
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.
Originally created by Eli Betito and Ori Ben Arzty
The following sections are generated by terraform-docs and markdown-table-formatter, please DO NOT MODIFY THEM MANUALLY!
Name | Version |
---|---|
terraform | >= 1.3 |
azurerm | >= 3.47, < 4.0 |
modtm | ~> 0.3 |
random | ~> 3.5 |
Name | Version |
---|---|
azurerm | >= 3.47, < 4.0 |
modtm | ~> 0.3 |
random | ~> 3.5 |
No modules.
Name | Description | Type | Default | Required |
---|---|---|---|---|
default_subplan | (Optional) Resource type pricing default subplan. Contact your MSFT representative for possible values | string |
null |
no |
default_tier | (Optional) The pricing tier to use. Possible values are Free and Standard
|
string |
"Standard" |
no |
enable_telemetry | This variable controls whether or not telemetry is enabled for the module.For more information see https://aka.ms/avm/telemetryinfo.If it is set to false, then no telemetry will be collected. | bool |
true |
no |
location | (Optional) The location/region where the policy should exist. | string |
"West Europe" |
no |
mdc_databases_plans | (Optional) Set of all MDC databases plans | set(string) |
[ "OpenSourceRelationalDatabases", "SqlServers", "SqlServerVirtualMachines", "CosmosDbs"] | no |
mdc_plans_list | (Optional) Set of all MDC plans | set(string) |
[ "AppServices", "Arm", "CloudPosture", "Containers", "KeyVaults", "OpenSourceRelationalDatabases", "SqlServers", "SqlServerVirtualMachines", "CosmosDbs", "StorageAccounts", "VirtualMachines", "Api"] | no |
storage_accounts_malware_scan_cap_gb_per_month | (Optional) Sets the maximum GB limit for malware scanning on uploaded files per storage account per month | string |
"5000" |
no |
subplans | (Optional) A map of resource type pricing subplan, the key is resource type. This variable takes precedence over var.default_subplan . Contact your MSFT representative for possible values |
map(string) |
{} |
no |
tracing_tags_enabled | Whether enable tracing tags that generated by BridgeCrew Yor. | bool |
false |
no |
tracing_tags_prefix | Default prefix for generated tracing tags | string |
"avm_" |
no |
Name | Description |
---|---|
plans_details | All plans details |
subscription_pricing_id | The subscription pricing ID |