terraform-msgraph-security-copilot-utils/main.tf at main · libre-devops/terraform-msgraph-security-copilot-utils · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
locals {
  copilot_base = "security/securityCopilot/workspaces"

  # Resolve a prompt's parent session id: a raw session_id, or the created id of a session referenced
  # by session_key. try() guards the index so the unused branch of the conditional (Terraform
  # evaluates both) does not fail when session_key is null or absent.
  prompt_session_ids = {
    for k, v in var.prompts : k => v.session_id != null ? v.session_id : try(msgraph_resource.sessions[v.session_key].id, null)
  }

  # Resolve an evaluation's parent session and prompt ids the same way.
  evaluation_session_ids = {
    for k, v in var.evaluations : k => v.session_id != null ? v.session_id : try(msgraph_resource.sessions[v.session_key].id, null)
  }
  evaluation_prompt_ids = {
    for k, v in var.evaluations : k => v.prompt_id != null ? v.prompt_id : try(msgraph_resource.prompts[v.prompt_key].id, null)
  }
}

# ---- Compute capacity (Azure ARM, azapi) ----
resource "azapi_resource" "compute_capacity" {
  for_each = var.compute_capacity

  type                      = "Microsoft.SecurityCopilot/capacities${each.value.azapi_version}"
  parent_id                 = each.value.resource_group_id
  name                      = each.value.name
  location                  = each.value.location
  tags                      = each.value.tags
  schema_validation_enabled = each.value.schema_validation_enabled
  response_export_values    = each.value.response_export_values
  ignore_missing_property   = each.value.ignore_missing_property
  ignore_null_property      = each.value.ignore_null_property
  ignore_casing             = each.value.ignore_casing

  body = {
    properties = {
      numberOfUnits   = each.value.number_of_units
      crossGeoCompute = each.value.cross_geo_compute
      geo             = each.value.geo
      overageState    = each.value.overage_state
      overageAmount   = each.value.overage_amount
    }
  }
}

# ---- Plugins (under a workspace) ----
resource "msgraph_resource" "plugins" {
  for_each = var.plugins

  url                    = "${local.copilot_base}/${each.value.workspace_id}/plugins"
  api_version            = coalesce(each.value.api_version, var.default_api_version)
  body                   = each.value.body
  update_method          = coalesce(each.value.update_method, "PATCH")
  response_export_values = each.value.response_export_values
}

# ---- Sessions (under a workspace) ----
resource "msgraph_resource" "sessions" {
  for_each = var.sessions

  url                    = "${local.copilot_base}/${each.value.workspace_id}/sessions"
  api_version            = coalesce(each.value.api_version, var.default_api_version)
  body                   = each.value.body
  update_method          = coalesce(each.value.update_method, "PATCH")
  response_export_values = each.value.response_export_values
}

# ---- Update existing sessions (PATCH) ----
resource "msgraph_update_resource" "session_updates" {
  for_each = var.session_updates

  url                    = "${local.copilot_base}/${each.value.workspace_id}/sessions/${each.value.session_id}"
  api_version            = coalesce(each.value.api_version, var.default_api_version)
  body                   = each.value.body
  response_export_values = each.value.response_export_values
}

# ---- Prompts (under a session) ----
resource "msgraph_resource" "prompts" {
  for_each = var.prompts

  url                    = "${local.copilot_base}/${each.value.workspace_id}/sessions/${local.prompt_session_ids[each.key]}/prompts"
  api_version            = coalesce(each.value.api_version, var.default_api_version)
  body                   = each.value.body
  update_method          = coalesce(each.value.update_method, "PATCH")
  response_export_values = each.value.response_export_values
}

# ---- Evaluations (under a prompt) ----
resource "msgraph_resource" "evaluations" {
  for_each = var.evaluations

  url                    = "${local.copilot_base}/${each.value.workspace_id}/sessions/${local.evaluation_session_ids[each.key]}/prompts/${local.evaluation_prompt_ids[each.key]}/evaluations"
  api_version            = coalesce(each.value.api_version, var.default_api_version)
  body                   = each.value.body
  update_method          = coalesce(each.value.update_method, "PATCH")
  response_export_values = each.value.response_export_values
}

# ---- Generic passthrough ----
resource "msgraph_resource" "resources" {
  for_each = var.resources

  url                    = each.value.url
  api_version            = coalesce(each.value.api_version, var.default_api_version)
  body                   = each.value.body
  update_method          = coalesce(each.value.update_method, "PATCH")
  response_export_values = each.value.response_export_values
}