Create VM Scanners ARM template

Powershell scripts/VM Scanners/onboardingTemplate.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "principalId": {
+      "type": "string",
+      "metadata": {
+        "description": "The principal to assign the role to, should be the object ID of the 'Microsoft Defender for Cloud Servers Scanner Resource Provider' application"
+      }
+    },
+    "roleNameGuid": {
+      "type": "string",
+      "defaultValue": "bd9ea6db-713e-43d0-a2ee-7ff61158181a",
+      "metadata": {
+        "description": "A new GUID used to identify the role assignment"
+      }
+    },
+    "roleName": {
+      "type": "string",
+      "defaultValue": "Custom Role - VM Scanner Operator",
+      "metadata": {
+        "description": "Friendly name of the role definition"
+      }
+    },
+    "exclusionTags": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Dictionary of string key-value pairs representing the tags used to exclude resources from being scanned. Resources tagged with one of these values will not be scanned. The values in the dictionary are case-sensitive"
+      }
+    },
+    "vmScannerRgName": {
+      "type": "string",
+      "metadata": {
+        "description": "The resource group in which the VmScanners resource will be created"
+      }
+    },
+    "vmScannerRgLocation": {
+      "type": "string",
+      "defaultValue": "westeurope",
+      "metadata": {
+        "description": "Location for creating the resource."
+      }
+    }
+  },
+  "variables": {
+    "actions": [
+      "Microsoft.Compute/disks/read",
+      "Microsoft.Compute/disks/beginGetAccess/action",
+      "Microsoft.Compute/virtualMachines/instanceView/read",
+      "Microsoft.Compute/virtualMachines/read",
+      "Microsoft.Compute/virtualMachineScaleSets/instanceView/read",
+      "Microsoft.Compute/virtualMachineScaleSets/read",
+      "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
+      "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read"
+    ],
+    "notActions": [],
+    "roleDefName": "[guid(subscription().id, string(variables('actions')), string(variables('notActions')))]"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Authorization/roleDefinitions",
+      "apiVersion": "2018-07-01",
+      "name": "[variables('roleDefName')]",
+      "properties": {
+        "roleName": "[parameters('roleName')]",
+        "description": "Used by Microsoft Defender for Cloud to scan VMs",
+        "type": "customRole",
+        "permissions": [
+          {
+            "actions": "[variables('actions')]",
+            "notActions": "[variables('notActions')]"
+          }
+        ],
+        "assignableScopes": [
+          "[subscription().id]"
+        ]
+      }
+    },
+    {
+      "type": "Microsoft.Authorization/roleAssignments",
+      "apiVersion": "2020-04-01-preview",
+      "name": "[parameters('roleNameGuid')]",
+      "dependsOn": [
+        "[resourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefName'))]"
+      ],
+      "properties": {
+        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefName'))]",
+        "principalId": "[parameters('principalId')]"
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2020-10-01",
+      "name": "vmScannersResourceRgTemplate",
+      "dependsOn": [
+        "[resourceId('Microsoft.Authorization/roleAssignments', parameters('roleNameGuid'))]"
+      ],
+      "properties": {
+        "mode": "Incremental",
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "resources": [
+            {
+              "type": "Microsoft.Security/vmScanners",
+              "location": "[parameters('vmScannerRgLocation')]",
+              "apiVersion": "2022-03-01-preview",
+              "name": "default",
+              "properties": {
+                "scanningMode": "Default",
+                "exclusionTags": "[parameters('exclusionTags')]"
+              }
+            }
+          ]
+        }
+      },
+      "resourceGroup": "[parameters('vmScannerRgName')]"
+    }
+  ]
+}