> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://cla-demo.postmansolutions.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://cla-demo.postmansolutions.com/_mcp/server.

# Infrastructure Overview Malware Scanning Integration

## Purpose

Define infrastructure-as-code changes required to enable Microsoft Defender for Storage malware scanning on upload-facing storage accounts

This specification covers Defender enablement only. Event delivery and application behavior are addressed separately

---

## Scope

* Extend the existing storage\_account Terraform module
* Enable Defender for Storage as an optional capability
* Modules for `event_grid_system_topic` and `event_grid_subscription` need to be created.

---

## az-modules-tf

### storage\_account module

#### New input variables

Add the following variables to variables.tf:

* enable\_defender\_for\_storage
  * Type: bool
  * Default: false
  * Enables Microsoft Defender for Storage on the account

* enable\_malware\_scanning\_on\_upload
  * Type: bool
  * Default: false
  * Enables malware scanning for blobs on upload
  * Requires enable\_defender\_for\_storage to be true

---

#### New resource (conditional)

Add the following resource to `storage_account.tf`:

* `azurerm_security_center_storage_defender`

Creation conditions:

* Created only when enable\_defender\_for\_storage is true

Configuration:

* `storage_account_id` references `azurerm_storage_account.storage_account.id`
* `malware_scanning_on_upload_enabled` is set from `enable_malware_scanning_on_upload`

No other storage account behavior is modified

---

## az-adc-lz-tf

### Stack usage guidelines

For upload-facing storage accounts:

* `enable_defender_for_storage` = true
* `enable_malware_scanning_on_upload` = true

For non-upload storage accounts:

* Leave both values as false

---

## Event Grid Integration

Event Grid configuration is a separate concern and is not handled by the storage\_account module

Expected configuration:

* Event Grid system topic per storage account
* Event Grid subscription targeting Azure Service Bus
* Event Grid identity assigned `Azure Service Bus Data Sender` role

Defender enablement does not create or modify Event Grid resources

---

## Responsibilities by Layer

### Infrastructure

* Enable Defender for Storage
* Enable malware scanning on upload
* Provide scan result events via Event Grid

### Platform Services

* Consume scan result events from Service Bus
* Persist Defender scan results
* Enforce processing gates based on scan results

---

## Outcome

* Defender for Storage is enabled as a first-class storage account capability
* Malware scanning is controlled through explicit module inputs
* Event routing and application behavior remain decoupled from IaC
* Changes are compatible with existing module design and SpaceLift usage