`integrations.microsoft_defender_for_cloud_cspm` — version 0.1

Source: presets/integrations/microsoft-defender-for-cloud-cspm.satz

Purpose

Microsoft Defender for Cloud — the CSPM plan.

Used beside the foundation pack, gated on the licence:

The custom role this plan grants is NOT here: it depends on the access mode, so it lives in its own fragment (-cspm-role-default or -cspm-role-least-privilege) and exactly one of those is used. This file is the part that is the same either way.

Everything is declared at top level with an explicit project, because a fragment cannot nest into the project the foundation pack defines.

Use it

params {
  mdc_plan_cspm = true
}

use "presets/integrations/microsoft-defender-for-cloud-cspm.satz" when mdc_plan_cspm

mdc_plan_cspm is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by integrations.microsoft_defender_for_cloud, and the estate's own binding wins.

Needs from outside the pack:

customer_organization_id — declared by estate_core; use one of them alongside, or declare it in the estate.
mdc_mgmt_project_id — declared by integrations.microsoft_defender_for_cloud; use one of them alongside, or declare it in the estate.
mdc_workload_pool_id — declared by integrations.microsoft_defender_for_cloud; use one of them alongside, or declare it in the estate.

Params

None — the pack takes everything from the estate's params.

Contributes

resource type	labels
`google_iam_workload_identity_pool_provider`	`mdc_cspm`
`google_organization_iam_member`	`serviceAccount:microsoft-defender-cspm@{mdc_mgmt_project_id}.iam.gserviceaccount.com (grant map)`
`google_service_account`	`mdc_cspm`
`google_service_account_iam_member`	`service_account_id (grant map)`, `principalSet://iam.googleapis.com/projects/${google_project.mdc_mgmt.number}/locations/global/workloadIdentityPools/{mdc_workload_pool_id}/* (grant map)`

Claims

None — this pack proves no control by itself.

History

version	date	change
0.1	2026-09-03	first cut — the CSPM plan behind `mdc_plan_cspm`: its service account, OIDC provider, workload-identity assignment and org grants. The custom role is not here: it depends on the access mode

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

The CSPM plan's own fragment, added by hand beside the foundation pack (integrations.microsoft_defender_for_cloud) which owns the project and the pool it uses.

It needs exactly one role fragment: the default five-permission role or the 82-permission least-privilege role.

integrations.microsoft_defender_for_cloud_cspm — version 0.1