Microsoft.Synapse workspaces/vulnerabilityAssessments 2021-04-01-preview

• Latest
• 2021-06-01
• 2021-06-01-preview
• 2021-05-01
• 2021-04-01-preview
• 2021-03-01
• 2020-12-01
• 2019-06-01-preview

Bicep resource definition

The workspaces/vulnerabilityAssessments resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Synapse/workspaces/vulnerabilityAssessments resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Synapse/workspaces/vulnerabilityAssessments@2021-04-01-preview' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    recurringScans: {
      emails: [
        'string'
      ]
      emailSubscriptionAdmins: bool
      isEnabled: bool
    }
    storageAccountAccessKey: 'string'
    storageContainerPath: 'string'
    storageContainerSasKey: 'string'
  }
}

Property Values

Microsoft.Synapse/workspaces/vulnerabilityAssessments

Name	Description	Value
name	The resource name	'default' (required)
parent	In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource.	Symbolic name for resource of type: workspaces
properties	Resource properties.	ServerVulnerabilityAssessmentProperties

ServerVulnerabilityAssessmentProperties

Name	Description	Value
recurringScans	The recurring scans settings	VulnerabilityAssessmentRecurringScansProperties
storageAccountAccessKey	Specifies the identifier key of the storage account for vulnerability assessment scan results. If 'StorageContainerSasKey' isn't specified, storageAccountAccessKey is required.	string
storageContainerPath	A blob storage container path to hold the scan results (e.g. https://myStorage.blob.core.windows.net/VaScans/).	string (required)
storageContainerSasKey	A shared access signature (SAS Key) that has read and write access to the blob container specified in 'storageContainerPath' parameter. If 'storageAccountAccessKey' isn't specified, StorageContainerSasKey is required.	string

VulnerabilityAssessmentRecurringScansProperties

Name	Description	Value
emails	Specifies an array of e-mail addresses to which the scan notification is sent.	string[]
emailSubscriptionAdmins	Specifies that the schedule scan notification will be is sent to the subscription administrators.	bool
isEnabled	Recurring scans state.	bool

ARM template resource definition

The workspaces/vulnerabilityAssessments resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.

Usage Examples

Resource format

To create a Microsoft.Synapse/workspaces/vulnerabilityAssessments resource, add the following JSON to your template.

{
  "type": "Microsoft.Synapse/workspaces/vulnerabilityAssessments",
  "apiVersion": "2021-04-01-preview",
  "name": "string",
  "properties": {
    "recurringScans": {
      "emails": [ "string" ],
      "emailSubscriptionAdmins": "bool",
      "isEnabled": "bool"
    },
    "storageAccountAccessKey": "string",
    "storageContainerPath": "string",
    "storageContainerSasKey": "string"
  }
}

Property Values

Microsoft.Synapse/workspaces/vulnerabilityAssessments

Name	Description	Value
apiVersion	The api version	'2021-04-01-preview'
name	The resource name	'default' (required)
properties	Resource properties.	ServerVulnerabilityAssessmentProperties
type	The resource type	'Microsoft.Synapse/workspaces/vulnerabilityAssessments'

ServerVulnerabilityAssessmentProperties

Name	Description	Value
recurringScans	The recurring scans settings	VulnerabilityAssessmentRecurringScansProperties
storageAccountAccessKey	Specifies the identifier key of the storage account for vulnerability assessment scan results. If 'StorageContainerSasKey' isn't specified, storageAccountAccessKey is required.	string
storageContainerPath	A blob storage container path to hold the scan results (e.g. https://myStorage.blob.core.windows.net/VaScans/).	string (required)
storageContainerSasKey	A shared access signature (SAS Key) that has read and write access to the blob container specified in 'storageContainerPath' parameter. If 'storageAccountAccessKey' isn't specified, StorageContainerSasKey is required.	string

VulnerabilityAssessmentRecurringScansProperties

Name	Description	Value
emails	Specifies an array of e-mail addresses to which the scan notification is sent.	string[]
emailSubscriptionAdmins	Specifies that the schedule scan notification will be is sent to the subscription administrators.	bool
isEnabled	Recurring scans state.	bool

Terraform (AzAPI provider) resource definition

The workspaces/vulnerabilityAssessments resource type can be deployed with operations that target:

• Resource groups For a list of changed properties in each API version, see change log.

Usage Examples

Terraform Samples

A basic example of deploying Vulnerability Assessment for a Synapse Workspace.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westus"
}

variable "sql_administrator_login_password" {
  type        = string
  sensitive   = true
  description = "The SQL administrator login password for the Synapse workspace"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "storageAccount" {
  type      = "Microsoft.Storage/storageAccounts@2023-05-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = "${var.resource_name}sa1"
  location  = var.location
  body = {
    kind = "StorageV2"
    properties = {
      accessTier                   = "Hot"
      allowBlobPublicAccess        = true
      allowCrossTenantReplication  = false
      allowSharedKeyAccess         = true
      defaultToOAuthAuthentication = false
      dnsEndpointType              = "Standard"
      encryption = {
        keySource = "Microsoft.Storage"
        services = {
          queue = {
            keyType = "Service"
          }
          table = {
            keyType = "Service"
          }
        }
      }
      isHnsEnabled       = true
      isLocalUserEnabled = true
      isNfsV3Enabled     = false
      isSftpEnabled      = false
      minimumTlsVersion  = "TLS1_2"
      networkAcls = {
        bypass              = "AzureServices"
        defaultAction       = "Allow"
        ipRules             = []
        resourceAccessRules = []
        virtualNetworkRules = []
      }
      publicNetworkAccess      = "Enabled"
      supportsHttpsTrafficOnly = true
    }
    sku = {
      name = "Standard_LRS"
    }
  }
}

resource "azapi_resource" "storageAccount_1" {
  type      = "Microsoft.Storage/storageAccounts@2023-05-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = "${var.resource_name}sa2"
  location  = var.location
  body = {
    kind = "StorageV2"
    properties = {
      accessTier                   = "Hot"
      allowBlobPublicAccess        = true
      allowCrossTenantReplication  = false
      allowSharedKeyAccess         = true
      defaultToOAuthAuthentication = false
      dnsEndpointType              = "Standard"
      encryption = {
        keySource = "Microsoft.Storage"
        services = {
          queue = {
            keyType = "Service"
          }
          table = {
            keyType = "Service"
          }
        }
      }
      isHnsEnabled       = true
      isLocalUserEnabled = true
      isNfsV3Enabled     = false
      isSftpEnabled      = false
      minimumTlsVersion  = "TLS1_2"
      networkAcls = {
        bypass              = "AzureServices"
        defaultAction       = "Allow"
        ipRules             = []
        resourceAccessRules = []
        virtualNetworkRules = []
      }
      publicNetworkAccess      = "Enabled"
      supportsHttpsTrafficOnly = true
    }
    sku = {
      name = "Standard_LRS"
    }
  }
}

resource "azapi_resource" "filesystem" {
  type      = "Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01"
  parent_id = "${azapi_resource.storageAccount.id}/blobServices/default"
  name      = "filesystem"
  body = {
    properties = {
      publicAccess = "None"
    }
  }
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.Synapse/workspaces@2021-06-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = "${var.resource_name}-workspace"
  location  = var.location
  identity {
    type         = "SystemAssigned"
    identity_ids = []
  }
  body = {
    properties = {
      azureADOnlyAuthentication = false
      defaultDataLakeStorage = {
        accountUrl = azapi_resource.storageAccount.output.properties.primaryEndpoints.dfs
        filesystem = azapi_resource.filesystem.name
      }
      managedResourceGroupName         = ""
      managedVirtualNetwork            = ""
      publicNetworkAccess              = "Enabled"
      sqlAdministratorLogin            = "sqladminuser"
      sqlAdministratorLoginPassword    = var.sql_administrator_login_password
      workspaceRepositoryConfiguration = {}
    }
  }
  depends_on = [azapi_resource.filesystem]
}

resource "azapi_resource_action" "storageAccountKeys" {
  type                   = "Microsoft.Storage/storageAccounts@2023-05-01"
  resource_id            = azapi_resource.storageAccount_1.id
  action                 = "listKeys"
  response_export_values = ["keys"]
}

resource "azapi_resource" "securityAlertPolicy" {
  type      = "Microsoft.Synapse/workspaces/securityAlertPolicies@2021-06-01"
  parent_id = azapi_resource.workspace.id
  name      = "Default"
  body = {
    properties = {
      state                   = "Enabled"
      storageAccountAccessKey = azapi_resource_action.storageAccountKeys.output.keys[0].value
      storageEndpoint         = azapi_resource.storageAccount_1.output.properties.primaryEndpoints.blob
    }
  }
}

resource "azapi_resource" "vulnerabilityAssessment" {
  type      = "Microsoft.Synapse/workspaces/vulnerabilityAssessments@2021-06-01"
  parent_id = azapi_resource.workspace.id
  name      = "default"
  body = {
    properties = {
      storageAccountAccessKey = azapi_resource_action.storageAccountKeys.output.keys[0].value
      storageContainerPath    = "${azapi_resource.storageAccount_1.output.properties.primaryEndpoints.blob}vulnerability-assessment"
    }
  }
  depends_on = [azapi_resource.securityAlertPolicy]
}

Resource format

To create a Microsoft.Synapse/workspaces/vulnerabilityAssessments resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Synapse/workspaces/vulnerabilityAssessments@2021-04-01-preview"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      recurringScans = {
        emails = [
          "string"
        ]
        emailSubscriptionAdmins = bool
        isEnabled = bool
      }
      storageAccountAccessKey = "string"
      storageContainerPath = "string"
      storageContainerSasKey = "string"
    }
  }
}

Property Values

Microsoft.Synapse/workspaces/vulnerabilityAssessments

Name	Description	Value
name	The resource name	'default' (required)
parent_id	The ID of the resource that is the parent for this resource.	ID for resource of type: workspaces
properties	Resource properties.	ServerVulnerabilityAssessmentProperties
type	The resource type	"Microsoft.Synapse/workspaces/vulnerabilityAssessments@2021-04-01-preview"

ServerVulnerabilityAssessmentProperties

Name	Description	Value
recurringScans	The recurring scans settings	VulnerabilityAssessmentRecurringScansProperties
storageAccountAccessKey	Specifies the identifier key of the storage account for vulnerability assessment scan results. If 'StorageContainerSasKey' isn't specified, storageAccountAccessKey is required.	string
storageContainerPath	A blob storage container path to hold the scan results (e.g. https://myStorage.blob.core.windows.net/VaScans/).	string (required)
storageContainerSasKey	A shared access signature (SAS Key) that has read and write access to the blob container specified in 'storageContainerPath' parameter. If 'storageAccountAccessKey' isn't specified, StorageContainerSasKey is required.	string

VulnerabilityAssessmentRecurringScansProperties

Name	Description	Value
emails	Specifies an array of e-mail addresses to which the scan notification is sent.	string[]
emailSubscriptionAdmins	Specifies that the schedule scan notification will be is sent to the subscription administrators.	bool
isEnabled	Recurring scans state.	bool