diff --git a/azurerm/internal/services/sentinel/registration.go b/azurerm/internal/services/sentinel/registration.go index 89b933289b5b..1f225cebe7b4 100644 --- a/azurerm/internal/services/sentinel/registration.go +++ b/azurerm/internal/services/sentinel/registration.go @@ -29,10 +29,11 @@ func (r Registration) SupportedDataSources() map[string]*schema.Resource { // SupportedResources returns the supported Resources supported by this Service func (r Registration) SupportedResources() map[string]*schema.Resource { return map[string]*schema.Resource{ - "azurerm_sentinel_alert_rule_fusion": resourceSentinelAlertRuleFusion(), - "azurerm_sentinel_alert_rule_ms_security_incident": resourceSentinelAlertRuleMsSecurityIncident(), - "azurerm_sentinel_alert_rule_scheduled": resourceSentinelAlertRuleScheduled(), - "azurerm_sentinel_data_connector_office_365": resourceSentinelDataConnectorOffice365(), - "azurerm_sentinel_data_connector_threat_intelligence": resourceSentinelDataConnectorThreatIntelligence(), + "azurerm_sentinel_alert_rule_fusion": resourceSentinelAlertRuleFusion(), + "azurerm_sentinel_alert_rule_ms_security_incident": resourceSentinelAlertRuleMsSecurityIncident(), + "azurerm_sentinel_alert_rule_scheduled": resourceSentinelAlertRuleScheduled(), + "azurerm_sentinel_data_connector_azure_active_directory": resourceSentinelDataConnectorAzureActiveDirectory(), + "azurerm_sentinel_data_connector_office_365": resourceSentinelDataConnectorOffice365(), + "azurerm_sentinel_data_connector_threat_intelligence": resourceSentinelDataConnectorThreatIntelligence(), } } diff --git a/azurerm/internal/services/sentinel/sentinel_data_connector_azure_active_directory.go b/azurerm/internal/services/sentinel/sentinel_data_connector_azure_active_directory.go new file mode 100644 index 000000000000..33bb0f99fb88 --- /dev/null +++ b/azurerm/internal/services/sentinel/sentinel_data_connector_azure_active_directory.go @@ -0,0 +1,165 @@ +package sentinel + +import ( + "fmt" + "log" + "time" + + "github.com/Azure/azure-sdk-for-go/services/preview/securityinsight/mgmt/2019-01-01-preview/securityinsight" + "github.com/hashicorp/terraform-plugin-sdk/helper/schema" + "github.com/hashicorp/terraform-plugin-sdk/helper/validation" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/helpers/tf" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients" + loganalyticsParse "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/loganalytics/parse" + loganalyticsValidate "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/loganalytics/validate" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/sentinel/parse" + azSchema "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/tf/schema" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/timeouts" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils" +) + +func resourceSentinelDataConnectorAzureActiveDirectory() *schema.Resource { + return &schema.Resource{ + Create: resourceSentinelDataConnectorAzureActiveDirectoryCreate, + Read: resourceSentinelDataConnectorAzureActiveDirectoryRead, + Delete: resourceSentinelDataConnectorAzureActiveDirectoryDelete, + + Importer: azSchema.ValidateResourceIDPriorToImportThen(func(id string) error { + _, err := parse.DataConnectorID(id) + return err + }, importSentinelDataConnector(securityinsight.DataConnectorKindAzureActiveDirectory)), + + Timeouts: &schema.ResourceTimeout{ + Create: schema.DefaultTimeout(30 * time.Minute), + Read: schema.DefaultTimeout(5 * time.Minute), + Delete: schema.DefaultTimeout(30 * time.Minute), + }, + + Schema: map[string]*schema.Schema{ + "name": { + Type: schema.TypeString, + Required: true, + ForceNew: true, + ValidateFunc: validation.StringIsNotEmpty, + }, + + "log_analytics_workspace_id": { + Type: schema.TypeString, + Required: true, + ForceNew: true, + ValidateFunc: loganalyticsValidate.LogAnalyticsWorkspaceID, + }, + + "tenant_id": { + Type: schema.TypeString, + Optional: true, + Computed: true, + ForceNew: true, + ValidateFunc: validation.IsUUID, + }, + }, + } +} + +func resourceSentinelDataConnectorAzureActiveDirectoryCreate(d *schema.ResourceData, meta interface{}) error { + client := meta.(*clients.Client).Sentinel.DataConnectorsClient + ctx, cancel := timeouts.ForCreateUpdate(meta.(*clients.Client).StopContext, d) + defer cancel() + + workspaceId, err := loganalyticsParse.LogAnalyticsWorkspaceID(d.Get("log_analytics_workspace_id").(string)) + if err != nil { + return err + } + name := d.Get("name").(string) + id := parse.NewDataConnectorID(workspaceId.SubscriptionId, workspaceId.ResourceGroup, workspaceId.WorkspaceName, name) + + if d.IsNewResource() { + resp, err := client.Get(ctx, id.ResourceGroup, OperationalInsightsResourceProvider, id.WorkspaceName, name) + if err != nil { + if !utils.ResponseWasNotFound(resp.Response) { + return fmt.Errorf("checking for existing %s: %+v", id, err) + } + } + + if !utils.ResponseWasNotFound(resp.Response) { + return tf.ImportAsExistsError("azurerm_sentinel_data_connector_azure_active_directory", id.ID()) + } + } + + tenantId := d.Get("tenant_id").(string) + if tenantId == "" { + tenantId = meta.(*clients.Client).Account.TenantId + } + + param := securityinsight.AADDataConnector{ + Name: &name, + AADDataConnectorProperties: &securityinsight.AADDataConnectorProperties{ + TenantID: &tenantId, + DataTypes: &securityinsight.AlertsDataTypeOfDataConnector{ + Alerts: &securityinsight.AlertsDataTypeOfDataConnectorAlerts{ + State: securityinsight.Enabled, + }, + }, + }, + Kind: securityinsight.KindAzureActiveDirectory, + } + + if _, err = client.CreateOrUpdate(ctx, id.ResourceGroup, OperationalInsightsResourceProvider, id.WorkspaceName, id.Name, param); err != nil { + return fmt.Errorf("creating %s: %+v", id, err) + } + + d.SetId(id.ID()) + + return resourceSentinelDataConnectorAzureActiveDirectoryRead(d, meta) +} + +func resourceSentinelDataConnectorAzureActiveDirectoryRead(d *schema.ResourceData, meta interface{}) error { + client := meta.(*clients.Client).Sentinel.DataConnectorsClient + ctx, cancel := timeouts.ForRead(meta.(*clients.Client).StopContext, d) + defer cancel() + + id, err := parse.DataConnectorID(d.Id()) + if err != nil { + return err + } + workspaceId := loganalyticsParse.NewLogAnalyticsWorkspaceID(id.SubscriptionId, id.ResourceGroup, id.WorkspaceName) + + resp, err := client.Get(ctx, id.ResourceGroup, OperationalInsightsResourceProvider, id.WorkspaceName, id.Name) + if err != nil { + if utils.ResponseWasNotFound(resp.Response) { + log.Printf("[DEBUG] %s was not found - removing from state!", id) + d.SetId("") + return nil + } + + return fmt.Errorf("retrieving %s: %+v", id, err) + } + + dc, ok := resp.Value.(securityinsight.AADDataConnector) + if !ok { + return fmt.Errorf("%s was not an Azure Active Directory Data Connector", id) + } + + d.Set("name", id.Name) + d.Set("log_analytics_workspace_id", workspaceId.ID()) + d.Set("tenant_id", dc.TenantID) + + return nil +} + +func resourceSentinelDataConnectorAzureActiveDirectoryDelete(d *schema.ResourceData, meta interface{}) error { + client := meta.(*clients.Client).Sentinel.DataConnectorsClient + ctx, cancel := timeouts.ForDelete(meta.(*clients.Client).StopContext, d) + defer cancel() + + id, err := parse.DataConnectorID(d.Id()) + if err != nil { + return err + } + + if _, err = client.Delete(ctx, id.ResourceGroup, OperationalInsightsResourceProvider, id.WorkspaceName, id.Name); err != nil { + return fmt.Errorf("deleting %s: %+v", id, err) + } + + return nil +} diff --git a/azurerm/internal/services/sentinel/sentinel_data_connector_azure_active_directory_test.go b/azurerm/internal/services/sentinel/sentinel_data_connector_azure_active_directory_test.go new file mode 100644 index 000000000000..31e0e55aa0d5 --- /dev/null +++ b/azurerm/internal/services/sentinel/sentinel_data_connector_azure_active_directory_test.go @@ -0,0 +1,142 @@ +package sentinel_test + +import ( + "context" + "fmt" + "testing" + + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/sentinel" + + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/services/sentinel/parse" + + "github.com/hashicorp/terraform-plugin-sdk/helper/resource" + "github.com/hashicorp/terraform-plugin-sdk/terraform" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/acceptance/check" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/internal/clients" + "github.com/terraform-providers/terraform-provider-azurerm/azurerm/utils" +) + +type SentinelDataConnectorAzureActiveDirectoryResource struct{} + +func TestAccAzureRMSentinelDataConnectorAzureActiveDirectory_basic(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_sentinel_data_connector_azure_active_directory", "test") + r := SentinelDataConnectorAzureActiveDirectoryResource{} + + data.ResourceTest(t, r, []resource.TestStep{ + { + Config: r.basic(data), + Check: resource.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.ImportStep(), + }) +} + +func TestAccAzureRMSentinelDataConnectorAzureActiveDirectory_complete(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_sentinel_data_connector_azure_active_directory", "test") + r := SentinelDataConnectorAzureActiveDirectoryResource{} + + data.ResourceTest(t, r, []resource.TestStep{ + { + Config: r.complete(data), + Check: resource.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.ImportStep(), + }) +} + +func TestAccAzureRMSentinelDataConnectorAzureActiveDirectory_requiresImport(t *testing.T) { + data := acceptance.BuildTestData(t, "azurerm_sentinel_data_connector_azure_active_directory", "test") + r := SentinelDataConnectorAzureActiveDirectoryResource{} + + data.ResourceTest(t, r, []resource.TestStep{ + { + Config: r.basic(data), + Check: resource.ComposeTestCheckFunc( + check.That(data.ResourceName).ExistsInAzure(r), + ), + }, + data.RequiresImportErrorStep(r.requiresImport), + }) +} + +func (r SentinelDataConnectorAzureActiveDirectoryResource) Exists(ctx context.Context, clients *clients.Client, state *terraform.InstanceState) (*bool, error) { + client := clients.Sentinel.DataConnectorsClient + + id, err := parse.DataConnectorID(state.ID) + if err != nil { + return nil, err + } + + if resp, err := client.Get(ctx, id.ResourceGroup, sentinel.OperationalInsightsResourceProvider, id.WorkspaceName, id.Name); err != nil { + if utils.ResponseWasNotFound(resp.Response) { + return utils.Bool(false), nil + } + return nil, fmt.Errorf("retrieving %s: %+v", id, err) + } + + return utils.Bool(true), nil +} + +func (r SentinelDataConnectorAzureActiveDirectoryResource) basic(data acceptance.TestData) string { + template := r.template(data) + return fmt.Sprintf(` +%s + +resource "azurerm_sentinel_data_connector_azure_active_directory" "test" { + name = "accTestDC-%d" + log_analytics_workspace_id = azurerm_log_analytics_workspace.test.id +} +`, template, data.RandomInteger) +} + +func (r SentinelDataConnectorAzureActiveDirectoryResource) complete(data acceptance.TestData) string { + template := r.template(data) + return fmt.Sprintf(` +%s + +data "azurerm_client_config" "test" {} + +resource "azurerm_sentinel_data_connector_azure_active_directory" "test" { + name = "accTestDC-%d" + log_analytics_workspace_id = azurerm_log_analytics_workspace.test.id + tenant_id = data.azurerm_client_config.test.tenant_id +} +`, template, data.RandomInteger) +} + +func (r SentinelDataConnectorAzureActiveDirectoryResource) requiresImport(data acceptance.TestData) string { + template := r.basic(data) + return fmt.Sprintf(` +%s + +resource "azurerm_sentinel_data_connector_azure_active_directory" "import" { + name = azurerm_sentinel_data_connector_azure_active_directory.test.name + log_analytics_workspace_id = azurerm_sentinel_data_connector_azure_active_directory.test.log_analytics_workspace_id +} +`, template) +} + +func (r SentinelDataConnectorAzureActiveDirectoryResource) template(data acceptance.TestData) string { + return fmt.Sprintf(` +provider "azurerm" { + features {} +} + +resource "azurerm_resource_group" "test" { + name = "acctestRG-sentinel-%d" + location = "%s" +} + +resource "azurerm_log_analytics_workspace" "test" { + name = "acctestLAW-%d" + location = azurerm_resource_group.test.location + resource_group_name = azurerm_resource_group.test.name + sku = "PerGB2018" +} +`, data.RandomInteger, data.Locations.Primary, data.RandomInteger) +} diff --git a/website/azurerm.erb b/website/azurerm.erb index b9d310e95f60..d748fdfc5e44 100644 --- a/website/azurerm.erb +++ b/website/azurerm.erb @@ -2899,6 +2899,10 @@ azurerm_sentinel_alert_rule_scheduled +
  • + azurerm_sentinel_data_connector_azure_active_directory +
    • +
  • azurerm_sentinel_data_connector_office_365
    • diff --git a/website/docs/r/sentinel_data_connector_azure_active_directory.html.markdown b/website/docs/r/sentinel_data_connector_azure_active_directory.html.markdown new file mode 100644 index 000000000000..e60c16f24b18 --- /dev/null +++ b/website/docs/r/sentinel_data_connector_azure_active_directory.html.markdown @@ -0,0 +1,66 @@ +--- +subcategory: "Sentinel" +layout: "azurerm" +page_title: "Azure Resource Manager: azurerm_sentinel_data_connector_azure_active_directory" +description: |- + Manages a Azure Active Directory Data Connector. +--- + +# azurerm_sentinel_data_connector_azure_active_directory + +Manages a Azure Active Directory Data Connector. + +## Example Usage + +```hcl +resource "azurerm_resource_group" "example" { + name = "example-rg" + location = "west europe" +} + +resource "azurerm_log_analytics_workspace" "example" { + name = "example-workspace" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + sku = "PerGB2018" +} + +resource "azurerm_sentinel_data_connector_azure_active_directory" "example" { + name = "example" + log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id +} +``` + +## Arguments Reference + +The following arguments are supported: + +* `log_analytics_workspace_id` - (Required) The ID of the Log Analytics Workspace that this Azure Active Directory Data Connector resides in. Changing this forces a new Azure Active Directory Data Connector to be created. + +* `name` - (Required) The name which should be used for this Azure Active Directory Data Connector. Changing this forces a new Azure Active Directory Data Connector to be created. + +--- + +* `tenant_id` - (Optional) The ID of the tenant that this Azure Active Directory Data Connector connects to. Changing this forces a new Azure Active Directory Data Connector to be created. + +## Attributes Reference + +In addition to the Arguments listed above - the following Attributes are exported: + +* `id` - The ID of the Azure Active Directory Data Connector. + +## Timeouts + +The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/docs/configuration/resources.html#timeouts) for certain actions: + +* `create` - (Defaults to 30 minutes) Used when creating the Azure Active Directory Data Connector. +* `read` - (Defaults to 5 minutes) Used when retrieving the Azure Active Directory Data Connector. +* `delete` - (Defaults to 30 minutes) Used when deleting the Azure Active Directory Data Connector. + +## Import + +Azure Active Directory Data Connectors can be imported using the `resource id`, e.g. + +```shell +terraform import azurerm_sentinel_data_connector_azure_active_directory.example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/group1/providers/Microsoft.OperationalInsights/workspaces/workspace1/providers/Microsoft.SecurityInsights/dataConnectors/dc1 +```