integrations.microsoft_defender_for_cloud_cspm_role_default — version 0.1

Source: presets/integrations/microsoft-defender-for-cloud-cspm-role-default.satz

Purpose

Microsoft Defender for Cloud — the CSPM custom role, DEFAULT access mode.

Five permissions, because the plan also holds roles/viewer: together they are what Microsoft's script grants when least privilege is off. Use this OR the least-privilege fragment, never both — both define this role address, so both would be a fold conflict naming the two files.

Use it

params {
  mdc_cspm_default_access = true
}

use "presets/integrations/microsoft-defender-for-cloud-cspm-role-default.satz" when mdc_cspm_default_access

mdc_cspm_default_access is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by integrations.microsoft_defender_for_cloud, and the estate's own binding wins.

Needs from outside the pack:

• customer_organization_id — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

None — the pack takes everything from the estate's params.

Contributes

Claims

None — this pack proves no control by itself.

History

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

Use this OR the least-privilege role, never both: both define the same custom-role address, so an estate with both is a fold conflict naming the two files.

Five permissions beside roles/viewer, which is what Microsoft's own script grants.