如何通过Terraform启用Azure主机的File integrity monitoring？

要通过Terraform启用基于Azure Monitor Agent（AMA）的文件完整性监控，需完成三个核心步骤：部署Log Analytics工作区、安装AMA扩展到目标主机、配置FIM规则。以下是具体实现方案：

1. 配置Log Analytics工作区 #

FIM的监控日志将存储在Log Analytics工作区中，先定义该资源：

resource "azurerm_log_analytics_workspace" "fim_workspace" {
  name                = "fim-log-analytics"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
}

2. 部署Azure Monitor Agent到虚拟机 #

根据主机操作系统选择对应的扩展：

Windows主机 #

resource "azurerm_virtual_machine_extension" "ama_windows" {
  name                 = "AzureMonitorWindowsAgent"
  virtual_machine_id   = azurerm_windows_virtual_machine.example.id
  publisher            = "Microsoft.Azure.Monitor"
  type                 = "AzureMonitorWindowsAgent"
  type_handler_version = "1.16"

  settings = jsonencode({
    workspaceId = azurerm_log_analytics_workspace.fim_workspace.workspace_id
  })

  protected_settings = jsonencode({
    workspaceKey = azurerm_log_analytics_workspace.fim_workspace.primary_shared_key
  })

  depends_on = [azurerm_log_analytics_workspace.fim_workspace]
}

Linux主机 #

resource "azurerm_virtual_machine_extension" "ama_linux" {
  name                 = "AzureMonitorLinuxAgent"
  virtual_machine_id   = azurerm_linux_virtual_machine.example.id
  publisher            = "Microsoft.Azure.Monitor"
  type                 = "AzureMonitorLinuxAgent"
  type_handler_version = "1.15"

  settings = jsonencode({
    workspaceId = azurerm_log_analytics_workspace.fim_workspace.workspace_id
  })

  protected_settings = jsonencode({
    workspaceKey = azurerm_log_analytics_workspace.fim_workspace.primary_shared_key
  })

  depends_on = [azurerm_log_analytics_workspace.fim_workspace]
}

3. 启用FIM配置 #

通过专用资源关联主机与工作区，启用文件完整性监控：

resource "azurerm_defender_for_cloud_file_integrity_monitoring" "fim_config" {
  name                = "fim-config"
  resource_group_name = azurerm_resource_group.example.name
  workspace_id        = azurerm_log_analytics_workspace.fim_workspace.id
  virtual_machine_id  = azurerm_windows_virtual_machine.example.id # 替换为目标VM ID

  # 可选：自定义监控路径（默认监控系统关键目录）
  file_paths {
    windows_paths = ["C:\\Program Files\\", "C:\\Windows\\System32\\"]
    linux_paths   = ["/etc/", "/usr/bin/"]
  }
}

关键注意事项 #

• 确保目标虚拟机已启用Azure Defender for Cloud的服务器防护计划
• AMA扩展的type_handler_version需与虚拟机操作系统版本兼容，建议使用最新稳定版
• 批量部署时可结合Terraform的for_each循环处理多台虚拟机

验证部署 #

部署完成后，可通过两种方式确认FIM生效：

• 在Azure Defender for Cloud中，对应主机的"应在主机上启用File integrity monitoring"建议状态变为"已解决"
• 在Log Analytics工作区中查询ChangeTracking表，查看是否生成文件变更日志

内容的提问来源于stack exchange，提问作者One Developer