Azure Defender for Data Services settings are not supported on resources of type managedClusters

[shgopala1]

Is there an existing issue for this?

• [X] I have searched the existing issues

Community Note

• Please vote on this issue by adding a :thumbsup: reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

3.201.18

AzureRM Provider Version

3.17.0

Affected Resource(s)/Data Source(s)

azurerm_advanced_threat_protection

Terraform Configuration Files

module "windowsdefender" {
  source         = "./modules/windowsdefender"
  aks_cluster_id = module.AKS.aks_id
}

resource "azurerm_advanced_threat_protection" "akswindowsdefender" {
  target_resource_id = var.aks_cluster_id
  enabled            = true
}

Debug Output/Panic Output

module.windowsdefender.azurerm_advanced_threat_protection.akswindowsdefender: Creating...
╷
│ Error: checking for presence of existing Advanced Threat Protection for "/subscriptions/8773b64f-bf60-4ae9-b948-5e0f066624e7/resourceGroups/AzureDevops/providers/Microsoft.ContainerService/managedClusters/MSF-ADO-Pipelines-Agents": security.AdvancedThreatProtectionClient#Get: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="Not Supported" Message="Azure Defender for Data Services settings are not supported on resources of type managedClusters"
│ 
│   with module.windowsdefender.azurerm_advanced_threat_protection.akswindowsdefender,
│   on modules/windowsdefender/windowsdefender.tf line 1, in resource "azurerm_advanced_threat_protection" "akswindowsdefender":
│    1: resource "azurerm_advanced_threat_protection" "akswindowsdefender" {
│ 
╵

Expected Behaviour

No response

Actual Behaviour

No response

Steps to Reproduce

terraform plan:

• resource "azurerm_advanced_threat_protection" "akswindowsdefender" {
  • enabled = true
  • id = (known after apply)
  • target_resource_id = "/subscriptions/{subid}/resourceGroups/AzureDevops/providers/Microsoft.ContainerService/managedClusters/MSF-ADO-Pipelines-Agents" }

terraform apply fails

Important Factoids

No response

References

No response

[tombuildsstuff]

hi @shgopala1

Thanks for opening this issue.

Taking a look through here this error message is coming from the Azure API rather than Terraform, as such it appears that Azure Defender for Data Services isn't supported for AKS Clusters at this time. As such I believe this is working as intended at this time since this isn't supported for this resource - if you're expecting this to work have you got a reference to some Azure Documentation highlighting that this should work (which may require bumping the API version)?

Thanks!

[shgopala1]

@tombuildsstuff This is from Azure portal where the containers are clearly supported now:

[tombuildsstuff]

@shgopala1 Containers refers to ACI (Azure Container Image) - not AKS unfortunately

[shgopala1]

@tombuildsstuff Are you sure? These documentation clearly states that it is meant for Kubernetes clusters: https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-kubernetes-introduction

[sonaliborikar]

@tombuildsstuff @shgopala1 @caius @mitchellh any idea about the below issue?? Getting issue for Webapp & KeyVaults

[rcskosir]

Thanks for taking the time to open this issue. It appears as though this is now deprecated for Kubernetes as can be seen here: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-kubernetes-introduction, as such I am going to mark this issue as closed.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.