☁️ Azure Security Center Assessment Policy Terraform Module

module "minimum" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."
}

# REJECTED at plan time by this module.
module "wrong_word" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."

  severity              = "Moderate" # wrong: severity's middle value is Medium
  implementation_effort = "Medium"   # wrong: this field's middle value is Moderate
}

module "graded" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Key Vaults must enable purge protection"
  description  = "Detects Key Vaults without purge protection, which permits permanent secret loss."

  severity              = "Medium"   # Medium here
  implementation_effort = "Moderate" # Moderate here
  user_impact           = "Moderate" # and here
}

output "the_three_grades" {
  value = module.graded.grades
}

module "unknown_category" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."

  categories = ["Unknown"]
}

check "categories_say_something" {
  assert {
    condition     = !module.unknown_category.categories_include_the_unknown_api_artefact
    error_message = "categories contains Unknown, which records nothing about what this assessment covers. Either name the real categories or omit the field and let Azure compute it."
  }
}

# Leaves Azure to compute the categories.
module "computed_categories" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."
  # categories deliberately omitted
}

output "did_the_caller_choose" {
  value = {
    explicit = module.computed_categories.categories_set_explicitly # false
    value    = module.computed_categories.categories               # Azure's computed value
  }
}

module "categorised" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."

  categories = ["Compute", "Data", "IdentityAndAccess", "IoT", "Networking"]
}

module "threat_mapped" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Storage accounts must enforce HTTPS"
  description  = "Detects storage accounts that permit plain HTTP connections."

  threats = ["DataExfiltration", "DataSpillage"]
}

# REJECTED at plan time by this module.
module "case_dupe" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."

  categories = ["Compute", "compute"]
}

module "no_guidance" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Custom check"
  description  = "What this check looks for."
  # remediation_description deliberately omitted
}

check "recommendations_say_how_to_fix_the_problem" {
  assert {
    condition     = module.no_guidance.has_remediation_guidance
    error_message = "This assessment policy states a problem and offers no route out of it. Set remediation_description."
  }
}

module "editable" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Storage accounts must enforce HTTPS (revised)"
  description  = "Revised wording after the security review."

  severity   = "High"       # was Medium
  categories = ["Data"]     # was unset
}

output "guid_survives_edits" {
  value = {
    guid          = module.editable.name
    nothing_replaces = module.editable.no_argument_is_force_new
  }
}

module "policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Storage accounts must enforce HTTPS"
  description  = "Detects storage accounts that permit plain HTTP connections."
  severity     = "High"
}

output "wiring" {
  value = {
    pass_this_one = module.policy.id   # the full Resource ID
    not_this_one  = module.policy.name # the bare GUID
    confirmed     = module.policy.id_is_the_value_the_assessment_module_consumes
  }
}

locals {
  checks = {
    storage_https = {
      display_name = "Storage accounts must enforce HTTPS"
      description  = "Detects storage accounts that permit plain HTTP connections."
      severity     = "High"
      categories   = ["Data"]
      threats      = ["DataExfiltration"]
    }
    kv_purge = {
      display_name = "Key Vaults must enable purge protection"
      description  = "Detects Key Vaults without purge protection."
      severity     = "Medium"
      categories   = ["Data"]
      threats      = ["DataSpillage"]
    }
    nsg_wildcards = {
      display_name = "NSGs must not use wildcard rules"
      description  = "Detects network security groups with any-any rules."
      severity     = "High"
      categories   = ["Networking"]
      threats      = ["ElevationOfPrivilege"]
    }
  }
}

module "policies" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"
  for_each = local.checks

  display_name = each.value.display_name
  description  = each.value.description
  severity     = each.value.severity
  categories   = each.value.categories
  threats      = each.value.threats

  implementation_effort = "Moderate"
  user_impact           = "Low"
}

output "policy_ids_by_check" {
  value = { for k, m in module.policies : k => m.id }
}

provider "azurerm" {
  features {}
}

module "defender_plan" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-subscription-pricing.git?ref=v1.0.0"

  tier          = "Standard"
  resource_type = "StorageAccounts"
}

module "app_rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-app-eastus2"
  location = "eastus2"
  tags     = { workload = "shop", managed_by = "terraform" }
}

module "app_storage" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-storage-account.git?ref=v1.0.0"

  name                = "stshopeastus2"
  location            = module.app_rg.location
  resource_group_name = module.app_rg.name

  tags = { workload = "shop", managed_by = "terraform" }
}

# The recommendation definition. Subscription-scoped: no resource group, no location.
module "https_policy" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment-policy.git?ref=v1.0.0"

  display_name = "Storage accounts must enforce HTTPS"
  description  = "Detects storage accounts that permit plain HTTP connections."

  severity              = "High"
  implementation_effort = "Low"
  user_impact           = "Low"

  categories = ["Data"]
  threats    = ["DataExfiltration"]

  remediation_description = "Set supportsHttpsTrafficOnly to true on the storage account."
}

# The verdict for one resource. Nests under the storage account, and asserts rather than measures.
module "https_verdict" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-security-center-assessment.git?ref=v1.0.0"

  # The policy's id, NOT its name.
  assessment_policy_id = module.https_policy.id
  target_resource_id   = module.app_storage.id

  status = {
    code        = "Healthy"
    cause       = "supportsHttpsTrafficOnly is true"
    description = "Verified by the platform compliance scanner."
  }

  additional_data = {
    checked_by = "platform-compliance-scanner"
    checked_at = "2026-07-31T18:00:00Z"
  }
}

check "the_recommendation_tells_you_how_to_fix_it" {
  assert {
    condition     = module.https_policy.has_remediation_guidance
    error_message = "The assessment policy has no remediation_description, so the recommendation states a problem with no route out of it."
  }
}

check "the_categories_are_meaningful" {
  assert {
    condition     = !module.https_policy.categories_include_the_unknown_api_artefact
    error_message = "categories contains Unknown, which records nothing about what the assessment covers."
  }
}

check "the_verdict_records_how_it_was_reached" {
  assert {
    condition     = !module.https_verdict.records_no_provenance
    error_message = "The assessment records no additional_data, so nobody can tell how or when the verdict was determined - and nothing will ever re-evaluate it."
  }
}

output "custom_recommendation" {
  value = {
    policy_id       = module.https_policy.id
    policy_guid     = module.https_policy.name
    grades          = module.https_policy.grades
    verdict         = module.https_verdict.status_code
    verdict_is_asserted = module.https_verdict.this_records_an_asserted_result_not_a_computed_one
    verdict_is_frozen   = module.https_verdict.the_status_will_not_change_until_terraform_changes_it
  }
}

variable "severity" {
  type    = string
  default = "Medium"
  # Low | Medium | High  -- note MEDIUM, not Moderate. Case-sensitive.
}

variable "implementation_effort" {
  type    = string
  default = null
  # Low | Moderate | High -- note MODERATE, not Medium. Case-sensitive.
}

variable "user_impact" {
  type    = string
  default = null
  # Low | Moderate | High -- same vocabulary as implementation_effort.
}

variable "categories" {
  type    = set(string)
  default = null
  # Unknown | Compute | Data | IdentityAndAccess | IoT | Networking
  # null (not []) because the field is optional AND computed: an empty set would
  # overwrite what Azure computes. Unknown is an API artefact and is reported.
}

variable "threats" {
  type    = set(string)
  default = null
  # AccountBreach | DataExfiltration | DataSpillage | DenialOfService
  # ElevationOfPrivilege | MaliciousInsider | MissingCoverage | ThreatResistance
}