integrations.microsoft_defender_for_cloud_cspm_role_least_privilege — version 0.1

Source: presets/integrations/microsoft-defender-for-cloud-cspm-role-least-privilege.satz

Purpose

Microsoft Defender for Cloud — the CSPM custom role, LEAST PRIVILEGE mode.

The 82 permissions Microsoft's script enumerates when least privilege is on, in place of the five that ride on roles/viewer. Use this OR the default fragment, never both — both define this role address.

Microsoft's generated script also grants roles/viewer to the CSPM service account in this mode, and viewer covers the enumerated permissions. To drop viewer, the estate suppresses the grant: suppress google_organization_iam_member "serviceAccount:microsoft-defender-cspm@.iam.gserviceaccount.com" role "roles/viewer" The pack keeps the grant because the script makes it.

Use it

params {
  mdc_cspm_least_privilege = true
}

use "presets/integrations/microsoft-defender-for-cloud-cspm-role-least-privilege.satz" when mdc_cspm_least_privilege

mdc_cspm_least_privilege is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by integrations.microsoft_defender_for_cloud, and the estate's own binding wins.

Needs from outside the pack:

• customer_organization_id — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

None — the pack takes everything from the estate's params.

Contributes

Claims

None — this pack proves no control by itself.

History

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

Use this OR the default role, never both — both define the same custom-role address.

roles/viewer already covers all 82 permissions, so dropping viewer is the point: the estate suppresses that grant. The pack keeps it because Microsoft's script makes it, and a suppress in the estate is what removes it.