如何通过Terraform为Azure SQL Database启用Microsoft Defender for SQL

Microsoft Defender for SQL可在SQL Server级别或单个数据库级别配置，配置完成后自动继承对应维度的防护规则，具体实现方法如下：

前置依赖 #

• AzureRM Terraform Provider版本 >= 3.0.0，避免低版本资源字段不兼容
• Terraform环境已完成Azure身份认证，且已声明azurerm provider配置块

配置示例 #

方案1：SQL Server级配置（推荐） #

配置完成后该SQL Server下所有数据库默认启用Microsoft Defender for SQL，无需逐个库配置：

# 启用SQL Server级威胁检测（Microsoft Defender for SQL核心配置）
resource "azurerm_mssql_server_security_alert_policy" "defender_sql" {
  resource_group_name = azurerm_resource_group.example.name
  server_name         = azurerm_mssql_server.example.name
  state               = "Enabled"

  # 可选：填写需要禁用的告警类型，不填则默认启用所有威胁检测规则
  disabled_alerts = []
  # 可选：告警通知接收邮箱
  email_addresses      = ["security_admin@yourdomain.com"]
  email_account_admins = true
  retention_days       = 30
}

# 可选：开启漏洞扫描功能（属于Microsoft Defender for SQL内置功能模块）
resource "azurerm_mssql_server_vulnerability_assessment" "defender_scan" {
  server_security_alert_policy_id = azurerm_mssql_server_security_alert_policy.defender_sql.id
  # 替换为你自己的存储容器路径，用于存放扫描报告
  storage_container_path     = "${azurerm_storage_account.example.primary_blob_endpoint}${azurerm_storage_container.example.name}/"
  storage_account_access_key = azurerm_storage_account.example.primary_access_key

  recurring_scans {
    enabled                   = true
    email_subscription_admins = true
  }
}

方案2：单数据库级配置 #

仅为指定SQL Database启用Microsoft Defender for SQL，不影响同服务器下其他库：

resource "azurerm_mssql_database_security_alert_policy" "single_db_defender" {
  resource_group_name = azurerm_resource_group.example.name
  server_name         = azurerm_mssql_server.example.name
  database_name       = azurerm_mssql_database.example.name
  state               = "Enabled"

  email_addresses      = ["dba@yourdomain.com"]
  email_account_admins = true
}

生效验证 #

• 执行terraform plan检查配置语法，确认资源变更符合预期
• 执行terraform apply提交配置后，登录Azure门户进入对应SQL Server/数据库的「安全」-「Microsoft Defender for Cloud」页面，即可查看功能启用状态

内容的提问来源于stack exchange，提问作者Daniel Vega Ruiz