From fa7c6ddfbe96d70e86a500d505c0712e1ad30c18 Mon Sep 17 00:00:00 2001 From: RebeccaCalixte <262454636+Rebecca-Calixte@users.noreply.github.com> Date: Thu, 13 Aug 2026 23:40:32 -0400 Subject: [PATCH 1/2] Add AKS Defender for Containers quickstart --- .../101-aks-defender-containers/README.md | 130 ++++++++++++++++++ .../101-aks-defender-containers/main.tf | 104 ++++++++++++++ 2 files changed, 234 insertions(+) create mode 100644 quickstart/101-aks-defender-containers/README.md create mode 100644 quickstart/101-aks-defender-containers/main.tf diff --git a/quickstart/101-aks-defender-containers/README.md b/quickstart/101-aks-defender-containers/README.md new file mode 100644 index 000000000..1c3fb08a3 --- /dev/null +++ b/quickstart/101-aks-defender-containers/README.md @@ -0,0 +1,130 @@ +# Enable Microsoft Defender for Containers for AKS using Terraform + +This sample enables Microsoft Defender for Containers for an Azure Kubernetes Service (AKS) cluster using Terraform. + +Microsoft Defender for Containers helps protect Kubernetes environments by enabling security monitoring, vulnerability assessment, policy recommendations, and threat detection for container workloads. + +## Prerequisites + +Before you begin, make sure you have: + +- An Azure subscription +- Azure CLI installed and authenticated +- Terraform installed +- Permissions to create AKS clusters +- Permissions to enable Microsoft Defender for Cloud plans at the subscription level + +> [!IMPORTANT] +> Enabling the Defender for Containers plan applies at the subscription level. This can affect all supported container resources in the selected subscription. + +Verify your Azure session: + +```console +az login +az account show +``` + +## Terraform configuration + +The configuration in [main.tf](main.tf) performs the following actions: + +1. Creates a resource group. +2. Creates a Log Analytics workspace for AKS security monitoring data. +3. Enables the Defender for Containers plan at the subscription level. +4. Creates an AKS cluster with Azure Policy, OIDC issuer, and Microsoft Defender security monitoring enabled. +5. Outputs the resource group name, AKS cluster name, and Log Analytics workspace ID. + +## Initialize Terraform + +```console +terraform init +``` + +## Format and validate the configuration + +```console +terraform fmt +terraform validate +``` + +## Preview and apply the configuration + +Preview the resources Terraform will create or change: + +```console +terraform plan +``` + +Apply the configuration: + +```console +terraform apply +``` + +When prompted, enter `yes`. + +## Verify the Defender for Containers plan + +Verify that the Defender for Containers plan is enabled at the subscription level: + +```console +az security pricing show -n Containers -o table +``` + +The output should show the `Containers` plan with the `Standard` pricing tier: + +```text +Name PricingTier +---------- ------------ +Containers Standard +``` + +## Verify the AKS cluster configuration + +Check whether Azure Policy, OIDC, and Microsoft Defender security monitoring are enabled on the AKS cluster: + +```console +az aks show \ + --resource-group \ + --name \ + --query "{azurePolicy:addonProfiles.azurepolicy.enabled, oidc:oidcIssuerProfile.enabled, defender:securityProfile.defender}" \ + -o json +``` + +For PowerShell, use: + +```powershell +az aks show ` + --resource-group ` + --name ` + --query "{azurePolicy:addonProfiles.azurepolicy.enabled, oidc:oidcIssuerProfile.enabled, defender:securityProfile.defender}" ` + -o json +``` + +The output should show that Azure Policy is enabled, OIDC is enabled, and Microsoft Defender security monitoring is enabled: + +```json +{ + "azurePolicy": true, + "defender": { + "logAnalyticsWorkspaceResourceId": "", + "securityMonitoring": { + "enabled": true + } + }, + "oidc": true +} +``` + +## Clean up resources + +Delete the Azure resources created by this sample: + +```console +terraform destroy +``` + +When prompted, enter `yes`. + +> [!IMPORTANT] +> If the Defender for Containers pricing resource is managed by this Terraform configuration, destroying the configuration can change the subscription-level Containers plan. Confirm that you want to remove the plan before you run `terraform destroy`. diff --git a/quickstart/101-aks-defender-containers/main.tf b/quickstart/101-aks-defender-containers/main.tf new file mode 100644 index 000000000..3e64b2696 --- /dev/null +++ b/quickstart/101-aks-defender-containers/main.tf @@ -0,0 +1,104 @@ +terraform { + required_version = ">= 1.5.0" + + required_providers { + azurerm = { + source = "hashicorp/azurerm" + version = "~> 4.0" + } + } +} + +provider "azurerm" { + features {} +} + +data "azurerm_client_config" "current" {} + +locals { + suffix = substr(replace(data.azurerm_client_config.current.subscription_id, "-", ""), 0, 6) + location = "eastus" +} + +resource "azurerm_resource_group" "example" { + name = "rg-aks-defender-${local.suffix}" + location = local.location +} + +resource "azurerm_log_analytics_workspace" "example" { + name = "law-aks-defender-${local.suffix}" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + sku = "PerGB2018" + retention_in_days = 30 +} + +resource "azurerm_security_center_subscription_pricing" "containers" { + tier = "Standard" + resource_type = "Containers" + + extension { + name = "AgentlessVmScanning" + } + + extension { + name = "ContainerSensor" + } + + extension { + name = "AgentlessDiscoveryForKubernetes" + } + + extension { + name = "ContainerRegistriesVulnerabilityAssessments" + } + + extension { + name = "ContainerIntegrityContribution" + } +} + +resource "azurerm_kubernetes_cluster" "example" { + name = "aks-defender-${local.suffix}" + location = azurerm_resource_group.example.location + resource_group_name = azurerm_resource_group.example.name + dns_prefix = "aks-defender-${local.suffix}" + role_based_access_control_enabled = true + azure_policy_enabled = true + oidc_issuer_enabled = true + + default_node_pool { + name = "system" + node_count = 1 + vm_size = "Standard_D2s_v3" + } + + identity { + type = "SystemAssigned" + } + + microsoft_defender { + log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id + } + + tags = { + Environment = "Test" + Purpose = "DefenderForContainers" + } + + depends_on = [ + azurerm_security_center_subscription_pricing.containers + ] +} + +output "resource_group_name" { + value = azurerm_resource_group.example.name +} + +output "aks_cluster_name" { + value = azurerm_kubernetes_cluster.example.name +} + +output "log_analytics_workspace_id" { + value = azurerm_log_analytics_workspace.example.id +} From f0426bb187975af08bf429683e22ce3729437c76 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 23 Aug 2026 20:02:27 +0000 Subject: [PATCH 2/2] Fix AKS quickstart idempotency Co-authored-by: Rebecca-Calixte <262454636+Rebecca-Calixte@users.noreply.github.com> --- quickstart/101-aks-defender-containers/main.tf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/quickstart/101-aks-defender-containers/main.tf b/quickstart/101-aks-defender-containers/main.tf index 3e64b2696..3a0b18bd1 100644 --- a/quickstart/101-aks-defender-containers/main.tf +++ b/quickstart/101-aks-defender-containers/main.tf @@ -71,6 +71,12 @@ resource "azurerm_kubernetes_cluster" "example" { name = "system" node_count = 1 vm_size = "Standard_D2s_v3" + + upgrade_settings { + drain_timeout_in_minutes = 0 + max_surge = "10%" + node_soak_duration_in_minutes = 0 + } } identity {