first commit

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Jed Laundry
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,4 @@
+# terraform-azure-library
+
+My library of Terraform modules for Azure services.
+

conformity/README.md

@@ -0,0 +1,43 @@
+# conformity
+
+Terraform module for adding Trend Micro Cloud Conformity to Azure
+
+## Usage
+
+Import the module into a Terraform project:
+
+```terraform
+module "conformity" {
+  source          = "github.com/jlaundry/terraform-azure-library/conformity"
+  secret_end_date = "2022-01-01T00:00:01Z"
+}
+
+output "conformity_tenant_id" {
+    value = module.conformity.tenant_id
+}
+
+output "conformity_client_id" {
+    value = module.conformity.client_id
+}
+
+output "conformity_client_secret" {
+    value = module.conformity.client_secret
+    sensitive = true
+}
+```
+
+
+Run `terraform init && terraform apply`. The build will fail with an error:
+
+```
+│ Error: No service principal found for application ID: "xxxxxxxxxxxxx"
+│
+│   with module.conformity.data.azuread_service_principal.conformity,
+│   on .terraform/modules/conformity/main.tf line 69, in data "azuread_service_principal" "conformity":
+│   69: data "azuread_service_principal" "conformity" {
+│
+```
+
+You will need to go to the Azure portal, and **Grant admin consent** before proceeding. Then, run `terraform apply` again.
+
+Finally, copy the output variables into [the Create Azure Directory page](https://cloudone.trendmicro.com/conformity/add/azure/create-directory), and away you go.

conformity/main.tf

@@ -0,0 +1,115 @@
+
+terraform {
+  required_providers {
+    azuread = {
+      source = "hashicorp/azuread"
+    }
+    azurerm = {
+      source = "hashicorp/azurerm"
+    }
+  }
+}
+
+data "azuread_client_config" "current" {
+}
+
+data "azurerm_subscription" "primary" {
+}
+
+resource "azuread_application" "conformity" {
+  display_name               = "Trend Micro Cloud Conformity"
+
+  owners = [
+    data.azuread_client_config.current.object_id,
+  ]
+
+  required_resource_access {
+    resource_app_id = "00000002-0000-0000-c000-000000000000"  # Azure AD Graph
+
+    resource_access {
+        id   = "311a71cc-e848-46a1-bdf8-97ff7156d8e6"  # User.Read
+        type = "Scope"  # Delegated
+    }
+    resource_access {
+        id   = "c582532d-9d9e-43bd-a97c-2667a28ce295"  # User.Read.All
+        type = "Scope"  # Delegated
+    }
+    resource_access {
+        id   = "5778995a-e1bf-45b8-affa-663a9f3f4d04"  # Directory.Read.All
+        type = "Scope"  # Delegated
+    }
+    resource_access {
+        id   = "5778995a-e1bf-45b8-affa-663a9f3f4d04"  # Directory.Read.All
+        type = "Role"  # Application
+    }
+  }
+
+  required_resource_access {
+    resource_app_id = "00000003-0000-0000-c000-000000000000"  # Microsoft Graph
+
+    resource_access {
+        id   = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"  # User.Read
+        type = "Scope"  # Delegated
+    }
+    resource_access {
+        id   = "a154be20-db9c-4678-8ab7-66f6cc099a59"  # User.Read.All
+        type = "Scope"  # Delegated
+    }
+    resource_access {
+        id   = "df021288-bdef-4463-88db-98f22de89214"  # User.Read.All
+        type = "Role"  # Application
+    }
+    resource_access {
+        id   = "7ab1d382-f21e-4acd-a863-ba3e13f7da61"  # Directory.Read.All
+        type = "Role"  # Application
+    }
+  }
+}
+
+data "azuread_service_principal" "conformity" {
+  application_id = azuread_application.conformity.application_id
+}
+
+resource "random_password" "conformity" {
+  length           = 32
+  special          = false
+}
+
+resource "azuread_application_password" "conformity" {
+  application_object_id = azuread_application.conformity.id
+  description           = "Terraform managed"
+  value                 = random_password.conformity.result
+  end_date              = var.secret_end_date
+}
+
+resource "azurerm_role_definition" "conformity" {
+  name        = "Custom: Cloud Conformity"
+  scope       = data.azurerm_subscription.primary.id
+  description = "Subscription level custom role for Cloud One Conformity access."
+
+  permissions {
+    actions     = [
+                    "Microsoft.AppConfiguration/configurationStores/ListKeyValue/action",
+                    "Microsoft.Network/networkWatchers/queryFlowLogStatus/action",
+                    "Microsoft.Web/sites/config/list/Action",
+                    "Microsoft.Storage/storageAccounts/queueServices/queues/read"
+                ]
+    not_actions = []
+  }
+
+  assignable_scopes = [
+    data.azurerm_subscription.primary.id, # /subscriptions/00000000-0000-0000-0000-000000000000
+  ]
+}
+
+resource "azurerm_role_assignment" "conformity" {
+  scope              = data.azurerm_subscription.primary.id
+  role_definition_id = azurerm_role_definition.conformity.role_definition_resource_id
+  principal_id       = data.azuread_service_principal.conformity.id
+}
+
+resource "azurerm_role_assignment" "reader" {
+  scope                = data.azurerm_subscription.primary.id
+  role_definition_name = "Reader"
+  principal_id         = data.azuread_service_principal.conformity.id
+}

conformity/outputs.tf

@@ -0,0 +1,13 @@
+
+output "tenant_id" {
+    value = data.azuread_client_config.current.tenant_id
+}
+
+output "client_id" {
+    value = azuread_application.conformity.application_id
+}
+
+output "client_secret" {
+    value = random_password.conformity.result
+    sensitive = true
+}

conformity/vars.tf

@@ -0,0 +1,5 @@
+
+variable "secret_end_date" {
+    type = string
+    default = "2022-01-01T00:00:01Z"
+}

updatecompliance/main.tf

@@ -0,0 +1,39 @@
+
+locals {
+  suffix = "${lower(var.env)}-${lower(replace(var.location, " ", ""))}"
+}
+
+resource "random_id" "instance_id" {
+  byte_length = 4
+}
+
+resource "azurerm_resource_group" "rg" {
+  name     = "rg-updatecompliance-${local.suffix}"
+  location = var.location
+
+  tags = var.tags
+}
+
+resource "azurerm_log_analytics_workspace" "log" {
+  name                = "log-updatecompliance-${local.suffix}-${random_id.instance_id.hex}"
+  location            = azurerm_resource_group.rg.location
+  resource_group_name = azurerm_resource_group.rg.name
+  sku                 = "pergb2018"
+
+  tags = var.tags
+}
+
+resource "azurerm_log_analytics_solution" "wufb" {
+  solution_name         = "WaaSUpdateInsights"
+  location              = azurerm_resource_group.rg.location
+  resource_group_name   = azurerm_resource_group.rg.name
+  workspace_resource_id = azurerm_log_analytics_workspace.log.id
+  workspace_name        = azurerm_log_analytics_workspace.log.name
+
+  plan {
+    publisher = "Microsoft"
+    product   = "OMSGallery/WaaSUpdateInsights"
+  }
+
+  tags = var.tags
+}

updatecompliance/outputs.tf

@@ -0,0 +1,4 @@
+
+output "commercial_id" {
+  value = "TODO"
+}

updatecompliance/vars.tf

@@ -0,0 +1,12 @@
+
+variable "env" {
+    type = string
+}
+
+variable "location" {
+    type = string
+}
+
+variable "tags" {
+  type = map(string)
+}