terraform {
  required_version = ">= 1.5.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.90"
    }
  }
}
provider "azurerm" {
  features {}
}
# Fetch the current subscription context
data "azurerm_subscription" "current" {}
# Optional: Set a global contact email for security alerts
resource "azurerm_security_center_contact" "security_contact" {
  email               = "security-alerts@yourcompany.com"
  phone               = "+1234567890"
  alert_notifications = true
  alerts_to_admins    = true
}
# Define Defender plans to enable across the subscription
locals {
  defender_plans = [
    "VirtualMachines",
    "AppServices",
    "SqlServers",
    "SqlServerVirtualMachines",
    "StorageAccounts",
    "KubernetesService",
    "ContainerRegistry",
    "KeyVaults",
    "Arm",
    "Dns",
    "OpenSourceRelationalDatabases",
    "Containers",
    "CosmosDbs"
  ]
}
# Enable Defender for Cloud "Standard" tier for each resource type
resource "azurerm_security_center_subscription_pricing" "plans" {
  for_each      = toset(local.defender_plans)
  tier          = "Standard"
  resource_type = each.value
}
# Example: Enabling Defender CSPM with Agentless scanning extensions
resource "azurerm_security_center_subscription_pricing" "cloud_posture" {
  tier          = "Standard"
  resource_type = "CloudPosture"
  extension {
    name = "AgentlessVmScanning"
    additional_extension_properties = {
      ExclusionTags = "[]"
    }
  }
  extension {
    name = "ContainerRegistriesVulnerabilityAssessments"
  }
}