Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revised defender for cloud plan logic #960

Merged
merged 8 commits into from
Apr 5, 2024
Merged

Revised defender for cloud plan logic #960

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
721a0ff
revised logic and added structure
jayhaddad Apr 3, 2024
1a08b31
revised structure
jayhaddad Apr 3, 2024
4415b2c
added plan to var
jayhaddad Apr 3, 2024
aca7721
compile bicep
jayhaddad Apr 3, 2024
565f6f7
added plans compile bicep
jayhaddad Apr 3, 2024
369d816
cleanup conditions and recompile bicep
jayhaddad Apr 3, 2024
5257ebb
GitHub Action: Build Bicep to JSON
invalid-email-address Apr 3, 2024
d156eaa
Merge branch 'main' into deflogicrev-simple
jamasten Apr 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
89 changes: 78 additions & 11 deletions src/bicep/mlz.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
"_generator": {
"name": "bicep",
"version": "0.26.54.24096",
"templateHash": "7783918794036563591"
"templateHash": "1355067641298547562"
}
},
"parameters": {
Expand Down Expand Up @@ -8314,7 +8314,7 @@
"_generator": {
"name": "bicep",
"version": "0.26.54.24096",
"templateHash": "12295251709791687425"
"templateHash": "5540180824585554560"
}
},
"parameters": {
Expand Down Expand Up @@ -8378,7 +8378,7 @@
"_generator": {
"name": "bicep",
"version": "0.26.54.24096",
"templateHash": "2376507858724004427"
"templateHash": "8341967451228681010"
}
},
"parameters": {
Expand Down Expand Up @@ -8427,14 +8427,77 @@
},
"variables": {
"autoProvisioning": "[if(parameters('enableAutoProvisioning'), 'On', 'Off')]",
"defenderPaidPlansSpecialHandlingAzurePublicList": [
"Api"
],
"defenderPaidPlanConfig": {
"AzureCloud": {
"Api": {
"subPlan": "P1"
}
},
"appServices": {},
"KeyVaults": {
"subPlan": "PerKeyVault"
},
"Arm": {
"subPlan": "PerSubscription"
},
"CloudPosture": {
"extensions": [
{
"name": "SensitiveDataDiscovery",
"isEnabled": "True"
},
{
"name": "ContainerRegistriesVulnerabilityAssessments",
"isEnabled": "True"
},
{
"name": "AgentlessDiscoveryForKubernetes",
"isEnabled": "True"
},
{
"name": "AgentlessVmScanning",
"isEnabled": "True"
},
{
"name": "EntraPermissionsManagement",
"isEnabled": "True"
}
]
},
"Containers": {
"extensions": [
{
"name": "ContainerRegistriesVulnerabilityAssessments",
"isEnabled": "True"
},
{
"name": "AgentlessDiscoveryForKubernetes",
"isEnabled": "True"
}
]
},
"CosmosDbs": {},
"StorageAccounts": {
"subPlan": "DefenderForStorageV2",
"extensions": [
{
"name": "OnUploadMalwareScanning",
"isEnabled": "True",
"additionalExtensionProperties": {
"CapGBPerMonthPerStorageAccount": "5000"
}
},
{
"name": "SensitiveDataDiscovery",
"isEnabled": "True"
}
]
},
"VirtualMachines": {
"subPlan": "P1"
},
"SqlServerVirtualMachines": {},
"SqlServers": {},
"OpenSourceRelationalDatabases": {}
}
}
},
Expand All @@ -8446,7 +8509,7 @@
"mode": "serial",
"batchSize": 1
},
"condition": "[and(not(empty(parameters('defenderPlans'))), equals(parameters('defenderSkuTier'), 'Free'))]",
"condition": "[equals(parameters('defenderSkuTier'), 'Free')]",
"type": "Microsoft.Security/pricings",
"apiVersion": "2023-01-01",
"name": "[parameters('defenderPlans')[copyIndex()]]",
Expand All @@ -8461,7 +8524,7 @@
"mode": "serial",
"batchSize": 1
},
"condition": "[and(and(not(empty(parameters('defenderPlans'))), equals(parameters('defenderSkuTier'), 'Standard')), not(contains(variables('defenderPaidPlansSpecialHandlingAzurePublicList'), parameters('defenderPlans')[copyIndex()])))]",
"condition": "[and(equals(parameters('defenderSkuTier'), 'Standard'), not(equals(environment().name, 'AzureCloud')))]",
"type": "Microsoft.Security/pricings",
"apiVersion": "2023-01-01",
"name": "[parameters('defenderPlans')[copyIndex()]]",
Expand All @@ -8476,11 +8539,15 @@
"mode": "serial",
"batchSize": 1
},
"condition": "[and(and(and(not(empty(parameters('defenderPlans'))), equals(parameters('defenderSkuTier'), 'Standard')), contains(variables('defenderPaidPlansSpecialHandlingAzurePublicList'), parameters('defenderPlans')[copyIndex()])), equals(environment().name, 'AzureCloud'))]",
"condition": "[and(equals(parameters('defenderSkuTier'), 'Standard'), equals(environment().name, 'AzureCloud'))]",
"type": "Microsoft.Security/pricings",
"apiVersion": "2023-01-01",
"name": "[parameters('defenderPlans')[copyIndex()]]",
"properties": "[if(not(contains(variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]], 'subPlan')), createObject('pricingTier', parameters('defenderSkuTier')), createObject('pricingTier', parameters('defenderSkuTier'), 'subPlan', variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]].subPlan))]"
"properties": {
"pricingTier": "[parameters('defenderSkuTier')]",
"subPlan": "[if(contains(variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]], 'subPlan'), variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]].subPlan, json('null'))]",
"extensions": "[if(contains(variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]], 'extensions'), variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]].extensions, json('null'))]"
}
},
{
"type": "Microsoft.Security/autoProvisioningSettings",
Expand Down
99 changes: 86 additions & 13 deletions src/bicep/modules/defenderForCloud.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,19 +26,93 @@ param defenderSkuTier string = 'Free'

// Variables for Defender for Cloud Paid Plan Handling for AzureCloud only

var defenderPaidPlansSpecialHandlingAzurePublicList = ['Api']

var defenderPaidPlanConfig = {
AzureCloud: {
Api: {
subPlan: 'P1'
}
appServices: {
// Only requires sku defined, add future subplans and extensions here
}
KeyVaults: {
subPlan: 'PerKeyVault'
}
Arm: {
subPlan: 'PerSubscription'
}
CloudPosture: {
extensions: [
{
name: 'SensitiveDataDiscovery'
isEnabled: 'True'
}
{
name: 'ContainerRegistriesVulnerabilityAssessments'
isEnabled: 'True'
}
{
name: 'AgentlessDiscoveryForKubernetes'
isEnabled: 'True'
}
{
name: 'AgentlessVmScanning'
isEnabled: 'True'
}
{
name: 'EntraPermissionsManagement'
isEnabled: 'True'
}
]
}
Containers: {
extensions: [
{
name: 'ContainerRegistriesVulnerabilityAssessments'
isEnabled: 'True'
}
{
name: 'AgentlessDiscoveryForKubernetes'
isEnabled: 'True'
}
]
}
CosmosDbs: {
// Only requires sku defined, add future subplans and extensions here
}
StorageAccounts: {
subPlan: 'DefenderForStorageV2'
extensions: [
{
name: 'OnUploadMalwareScanning'
isEnabled: 'True'
additionalExtensionProperties: {
CapGBPerMonthPerStorageAccount: '5000'
}
}
{
name: 'SensitiveDataDiscovery'
isEnabled: 'True'
}
]
}
VirtualMachines: {
subPlan: 'P1'
}
SqlServerVirtualMachines: {
// Only requires sku defined, add future subplans and extensions here
}
SqlServers: {
// Only requires sku defined, add future subplans and extensions here
}
OpenSourceRelationalDatabases: {
// Only requires sku defined, add future subplans and extensions here
}
}
}

// Defender for Cloud - Free SKU turn on for all clouds
@batchSize(1)
resource defenderFreeAllClouds 'Microsoft.Security/pricings@2023-01-01' = [for name in defenderPlans: if (!empty(defenderPlans) && defenderSkuTier == 'Free') {
resource defenderFreeAllClouds 'Microsoft.Security/pricings@2023-01-01' = [for name in defenderPlans: if (defenderSkuTier == 'Free') {
name: name
properties: {
pricingTier: defenderSkuTier
Expand All @@ -49,37 +123,36 @@ resource defenderFreeAllClouds 'Microsoft.Security/pricings@2023-01-01' = [for n
// defender for cloud Standard SKU - No subplan, no extensions

@batchSize(1)
resource defenderStandardNoSubplanNoExtensions 'Microsoft.Security/pricings@2023-01-01' = [for name in defenderPlans: if (!empty(defenderPlans) && defenderSkuTier == 'Standard' && !contains(defenderPaidPlansSpecialHandlingAzurePublicList, name)) {
resource defenderStandardNoSubplanNoExtensions 'Microsoft.Security/pricings@2023-01-01' = [for name in defenderPlans: if (defenderSkuTier == 'Standard' && !(environment().name == 'AzureCloud')) {
name: name
properties: {
pricingTier: defenderSkuTier
}
}]


// defender for cloud Standard SKU - AzureCloud only - Handing instances with subplans must be defined
// defender for cloud Standard SKU - AzureCloud only - Handing all combinations This is the new example
@batchSize(1)
resource defenderStandardSubplanExtensionsAzureCloud 'Microsoft.Security/pricings@2023-01-01' = [for name in defenderPlans: if (!empty(defenderPlans) && defenderSkuTier == 'Standard' && contains(defenderPaidPlansSpecialHandlingAzurePublicList, name) && environment().name == 'AzureCloud'){
resource defenderStandardSubplanExtensionsAzureCloud 'Microsoft.Security/pricings@2023-01-01' = [for name in defenderPlans: if (defenderSkuTier == 'Standard' && environment().name == 'AzureCloud'){
name: name
properties: !contains(defenderPaidPlanConfig[environment().name][name], 'subPlan') ? {
pricingTier: defenderSkuTier
}:{
properties: {
pricingTier: defenderSkuTier
subPlan: defenderPaidPlanConfig[environment().name][name].subPlan
subPlan: contains(defenderPaidPlanConfig[environment().name][name],'subPlan') ? defenderPaidPlanConfig[environment().name][name].subPlan : json('null')
extensions: contains(defenderPaidPlanConfig[environment().name][name],'extensions') ? defenderPaidPlanConfig[environment().name][name].extensions : json('null')
}
}
]



// auto provisioing
#disable-next-line BCP081

resource autoProvision 'Microsoft.Security/autoProvisioningSettings@2019-01-01' = {
name: 'default'
properties: {
autoProvision: autoProvisioning
}
}

#disable-next-line BCP081
resource securityWorkspaceSettings 'Microsoft.Security/workspaceSettings@2019-01-01' = {
name: 'default'
properties: {
Expand Down