Skip to navigation
Research and SpikesMalware Scanning Approach

Infrastructure Overview Malware Scanning Integration

Purpose

Define infrastructure-as-code changes required to enable Microsoft Defender for Storage malware scanning on upload-facing storage accounts

This specification covers Defender enablement only. Event delivery and application behavior are addressed separately

Scope

  • Extend the existing storage_account Terraform module
  • Enable Defender for Storage as an optional capability
  • Modules for event_grid_system_topic and event_grid_subscription need to be created.

az-modules-tf

storage_account module

New input variables

Add the following variables to variables.tf:

  • enable_defender_for_storage

    • Type: bool
    • Default: false
    • Enables Microsoft Defender for Storage on the account

  • enable_malware_scanning_on_upload

    • Type: bool
    • Default: false
    • Enables malware scanning for blobs on upload
    • Requires enable_defender_for_storage to be true

New resource (conditional)

Add the following resource to storage_account.tf:

  • azurerm_security_center_storage_defender

Creation conditions:

  • Created only when enable_defender_for_storage is true

Configuration:

  • storage_account_id references azurerm_storage_account.storage_account.id
  • malware_scanning_on_upload_enabled is set from enable_malware_scanning_on_upload

No other storage account behavior is modified

az-adc-lz-tf

Stack usage guidelines

For upload-facing storage accounts:

  • enable_defender_for_storage = true
  • enable_malware_scanning_on_upload = true

For non-upload storage accounts:

  • Leave both values as false

Event Grid Integration

Event Grid configuration is a separate concern and is not handled by the storage_account module

Expected configuration:

  • Event Grid system topic per storage account
  • Event Grid subscription targeting Azure Service Bus
  • Event Grid identity assigned Azure Service Bus Data Sender role

Defender enablement does not create or modify Event Grid resources

Responsibilities by Layer

Infrastructure

  • Enable Defender for Storage
  • Enable malware scanning on upload
  • Provide scan result events via Event Grid

Platform Services

  • Consume scan result events from Service Bus
  • Persist Defender scan results
  • Enforce processing gates based on scan results

Outcome

  • Defender for Storage is enabled as a first-class storage account capability
  • Malware scanning is controlled through explicit module inputs
  • Event routing and application behavior remain decoupled from IaC
  • Changes are compatible with existing module design and SpaceLift usage