Azure Synapse Workspace Vulnerability Assessment
This page shows how to write Terraform and Azure Resource Manager for Synapse Workspace Vulnerability Assessment and write them securely.
azurerm_synapse_workspace_vulnerability_assessment (Terraform)
The Workspace Vulnerability Assessment in Synapse can be configured in Terraform with the resource name azurerm_synapse_workspace_vulnerability_assessment. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
The following arguments are supported:
workspace_security_alert_policy_id- (Required) The ID of the security alert policy of the Synapse Workspace. Changing this forces a new resource to be created.storage_container_path- (Required) A blob storage container path to hold the scan results (e.g. https://myStorage.blob.core.windows.net/VaScans/).storage_account_access_key- (Optional) Specifies the identifier key of the storage account for vulnerability assessment scan results. Ifstorage_container_sas_keyisn't specified,storage_account_access_keyis required.storage_container_sas_key- (Optional) A shared access signature (SAS Key) that has write access to the blob container specified instorage_container_pathparameter. Ifstorage_account_access_keyisn't specified,storage_container_sas_keyis required.recurring_scans- (Optional) The recurring scans settings. Therecurring_scansblock supports fields documented below.
recurring_scans supports the following:
enabled- (Optional) Boolean flag which specifies if recurring scans is enabled or disabled. Defaults tofalse.email_subscription_admins_enabled- (Optional) Boolean flag which specifies if the schedule scan notification will be sent to the subscription administrators. Defaults tofalse.emails- (Optional) Specifies an array of e-mail addresses to which the scan notification is sent.
The following attributes are exported:
id- The ID of the Synapse Workspace Vulnerability Assessment.
Explanation in Terraform Registry
Manages the Vulnerability Assessment for a Synapse Workspace.
Tips: Best Practices for The Other Azure Synapse Resources
In addition to the azurerm_synapse_workspace, Azure Synapse has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_synapse_workspace
Ensure to enable the managed virtual network
It is better to enable the managed virtual network, which is disabled as the default.
Microsoft.Synapse/workspaces/vulnerabilityAssessments (Azure Resource Manager)
The workspaces/vulnerabilityAssessments in Microsoft.Synapse can be configured in Azure Resource Manager with the resource name Microsoft.Synapse/workspaces/vulnerabilityAssessments. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"properties": {
"storageContainerPath": "https://myStorage.blob.core.windows.net/vulnerability-assessment/",
"recurringScans": {
"isEnabled": true,
"emailSubscriptionAdmins": false,
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"name": "default",
"existenceCondition": {
"field": "Microsoft.Synapse/workspaces/vulnerabilityAssessments/recurringScans.isEnabled",
"equals": "True"
}
"type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
"name": "default",
"existenceCondition": {
"field": "Microsoft.Synapse/workspaces/vulnerabilityAssessments/recurringScans.isEnabled",
"equals": "True"
}
Parameters
apiVersionrequired - stringnamerequired - stringThe name of the vulnerability assessment.
propertiesrequiredrecurringScansoptionalemailsoptional - arraySpecifies an array of e-mail addresses to which the scan notification is sent.
emailSubscriptionAdminsoptional - booleanSpecifies that the schedule scan notification will be is sent to the subscription administrators.
isEnabledoptional - booleanRecurring scans state.
storageAccountAccessKeyoptional - stringSpecifies the identifier key of the storage account for vulnerability assessment scan results. If 'StorageContainerSasKey' isn't specified, storageAccountAccessKey is required.
storageContainerPathrequired - stringA blob storage container path to hold the scan results (e.g. https://myStorage.blob.core.windows.net/VaScans/).
storageContainerSasKeyoptional - stringA shared access signature (SAS Key) that has read and write access to the blob container specified in 'storageContainerPath' parameter. If 'storageAccountAccessKey' isn't specified, StorageContainerSasKey is required.
typerequired - string
