feat(azure): add sensor-single module with VNet flow log support

.github/trivy/.trivyignore.yml

@@ -5,3 +5,7 @@ misconfigurations:
     statement: allow for legacy metadata service use
   - id: AVD-AWS-0107
     statement: bastion host requires SSH access from configurable CIDR blocks for administrative access
+  - id: AVD-AZU-0047
+    statement: sensor monitoring NIC requires configurable ingress CIDRs for VXLAN and health checks
+  - id: AVD-AZU-0051
+    statement: sensor requires outbound internet access for Fleet connectivity and updates

examples/azure/flow-sensor/README.md

@@ -0,0 +1,27 @@
+# Azure VNet Flow Sensor
+
+VNet Flow Logs sensor deployment.
+
+## Usage
+
+```bash
+cp terraform.tfvars.example terraform.tfvars
+# Edit terraform.tfvars with your values
+
+terraform init
+terraform plan
+terraform apply
+```
+
+## What This Deploys
+
+- A Corelight sensor VM (single instance) with management and monitoring NICs
+- A user-assigned Managed Identity with `Storage Blob Data Reader` on the flow logs storage account
+- The identity is attached to the sensor VM for VNet flow log access
+
+## Variables
+
+See [`terraform.tfvars.example`](./terraform.tfvars.example) for the full list
+of inputs.
+
+For deployment guidance, sizing, and architecture details, see the official Corelight documentation.

examples/azure/flow-sensor/main.tf

@@ -0,0 +1,36 @@
+module "vnet_flow_access" {
+  source = "../../../modules/azure/sensor-single/submodules/vnet_flow_storage_access"
+
+  resource_group_name = var.resource_group_name
+  location            = var.location
+  storage_account_id  = var.storage_account_id
+  identity_name       = "${var.deployment_name}-vnet-flow-identity"
+
+  tags = var.tags
+}
+
+module "sensor" {
+  source = "../../../modules/azure/sensor-single"
+
+  deployment_name           = var.deployment_name
+  location                  = var.location
+  resource_group_name       = var.resource_group_name
+  corelight_sensor_image_id = var.corelight_sensor_image_id
+  sensor_ssh_public_key     = var.sensor_ssh_public_key
+  community_string          = var.community_string
+
+  management_subnet_id = var.management_subnet_id
+  monitoring_subnet_id = var.monitoring_subnet_id
+
+  management_interface_public_ip = var.management_interface_public_ip
+  ssh_allow_cidrs                = var.ssh_allow_cidrs
+
+  license_key          = var.license_key
+  fleet_token          = var.fleet_token
+  fleet_url            = var.fleet_url
+  fleet_server_sslname = var.fleet_server_sslname
+
+  user_assigned_identity_ids = [module.vnet_flow_access.identity_id]
+
+  tags = var.tags
+}

examples/azure/flow-sensor/outputs.tf

@@ -0,0 +1,34 @@
+output "sensor_vm_id" {
+  description = "Resource ID of the flow sensor VM"
+  value       = module.sensor.sensor_vm_id
+}
+
+output "sensor_private_ip_address" {
+  description = "Private IP address of the sensor management NIC"
+  value       = module.sensor.sensor_private_ip_address
+}
+
+output "sensor_public_ip_address" {
+  description = "Public IP address of the sensor management NIC (if enabled)"
+  value       = module.sensor.sensor_public_ip_address
+}
+
+output "management_interface_id" {
+  description = "Network interface ID for management traffic"
+  value       = module.sensor.management_interface_id
+}
+
+output "monitoring_interface_id" {
+  description = "Network interface ID for monitoring traffic"
+  value       = module.sensor.monitoring_interface_id
+}
+
+output "vnet_flow_identity_id" {
+  description = "Resource ID of the managed identity for VNet flow log access"
+  value       = module.vnet_flow_access.identity_id
+}
+
+output "vnet_flow_identity_client_id" {
+  description = "Client ID of the managed identity (for sensor configuration)"
+  value       = module.vnet_flow_access.identity_client_id
+}

examples/azure/flow-sensor/terraform.tfvars.example

@@ -0,0 +1,42 @@
+# Azure Provider Configuration
+location = "eastus"
+
+# Tags
+tags = {
+  terraform   = "true"
+  purpose     = "Corelight"
+  environment = "<your-environment>"  # Example: production, staging, dev
+  project     = "<your-project-name>" # Example: network-security
+}
+
+# Deployment Configuration
+deployment_name = "<your-deployment-name>" # Example: my-flow-sensor (used as prefix for resource names)
+
+# Resource Group
+resource_group_name = "<your-resource-group>" # Example: corelight-flow-sensor-rg
+
+# Sensor Configuration
+corelight_sensor_image_id = "<corelight-sensor-image-id>" # Request from your Corelight account executive
+sensor_ssh_public_key     = "<your-ssh-public-key>"       # Contents of your SSH public key file
+community_string          = "<your-sensor-api-password>"  # Password for sensor API access
+
+# Licensing (Choose ONE option below)
+
+# Option A: License Key
+license_key = "<your-license-key>" # Your Corelight license key
+
+# Option B: Fleet Integration (comment out license_key if using Fleet)
+# fleet_token          = "<your-fleet-pairing-token>"    # From Fleet UI
+# fleet_url            = "<your-fleet-url>"              # Example: https://fleet.example.com:1443/fleet/v1/internal/softsensor/websocket
+# fleet_server_sslname = "<your-fleet-server-hostname>"  # Example: fleet.example.com
+
+# Network Configuration
+management_subnet_id       = "<management-subnet-id>" # Example: /subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Network/virtualNetworks/xxx/subnets/management
+monitoring_subnet_id       = "<monitoring-subnet-id>"  # Example: /subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Network/virtualNetworks/xxx/subnets/monitoring
+management_interface_public_ip = true                  # Set to false if not using public IP
+
+# Security Configuration
+ssh_allow_cidrs = ["<your-ip-cidr>"] # Example: ["10.0.0.0/8", "192.168.1.0/24"]
+
+# VNet Flow Logs Configuration
+storage_account_id = "<storage-account-resource-id>" # Example: /subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Storage/storageAccounts/vnetflowlogs

examples/azure/flow-sensor/tests/example.tftest.hcl

@@ -0,0 +1,58 @@
+# Unit tests for Azure Flow Sensor Example
+# These tests validate the example configuration
+
+mock_provider "azurerm" {}
+
+mock_provider "cloudinit" {}
+
+run "verify_default_configuration" {
+  command = plan
+
+  variables {
+    deployment_name           = "test-flow-sensor"
+    resource_group_name       = "test-rg"
+    corelight_sensor_image_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Compute/images/corelight-sensor"
+    sensor_ssh_public_key     = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7vbqajDRbQ3S3IGxwpasfG+JOSGX3gfpTeMKJT0hZpBA3E3t2I9oo5f3D5tNMFfxOrBdNjFqQ3NzsswFpBKST5HToAWpzuoFCHQsgqxP1JruHp+bh3faCheNBsqMSvp5bDPTN5F2JTbsOateCRYjM3DDmvxqP+xEePhXoLnJWFLhfp8jmeXlKjqKqSfvLrhQgKJmr+NFI9q9bFv3dPnfXPIn+akE37dyhLMpWnqXiPuDjRoSVisWQq/RvPuTGlOtWJGnvpqpUl3kn3aBDwN0b0+F3u5HG0gyVwpJRV9mA0Gs9E4A5iN1l/LjW+5ZjHqO8g3bRqpLniwRBjFZjG0wjI7F0gWluKuQvGT9PI6AAV9XZPH3EQ4w3O8FgPpsqJ9s7+HqXXt4DNdT7xELhE9bPJjnuKlPLPBFkVTBPoZ2r0E3BVjF51wvG8AJRJ3rUF7VPuDRPq5k6cqRpqYvOIHvjGPlU2gQ5SgusTXn3xfvcP0diP5F9I5itsOSikM2tSj0= test@example.com"
+    community_string          = "test-community"
+    management_subnet_id      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/management"
+    monitoring_subnet_id      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/monitoring"
+    license_key               = "test-license-key"
+    storage_account_id        = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Storage/storageAccounts/testflowlogs"
+  }
+}
+
+run "verify_with_fleet_integration" {
+  command = plan
+
+  variables {
+    deployment_name           = "test-flow-sensor"
+    resource_group_name       = "test-rg"
+    corelight_sensor_image_id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Compute/images/corelight-sensor"
+    sensor_ssh_public_key     = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7vbqajDRbQ3S3IGxwpasfG+JOSGX3gfpTeMKJT0hZpBA3E3t2I9oo5f3D5tNMFfxOrBdNjFqQ3NzsswFpBKST5HToAWpzuoFCHQsgqxP1JruHp+bh3faCheNBsqMSvp5bDPTN5F2JTbsOateCRYjM3DDmvxqP+xEePhXoLnJWFLhfp8jmeXlKjqKqSfvLrhQgKJmr+NFI9q9bFv3dPnfXPIn+akE37dyhLMpWnqXiPuDjRoSVisWQq/RvPuTGlOtWJGnvpqpUl3kn3aBDwN0b0+F3u5HG0gyVwpJRV9mA0Gs9E4A5iN1l/LjW+5ZjHqO8g3bRqpLniwRBjFZjG0wjI7F0gWluKuQvGT9PI6AAV9XZPH3EQ4w3O8FgPpsqJ9s7+HqXXt4DNdT7xELhE9bPJjnuKlPLPBFkVTBPoZ2r0E3BVjF51wvG8AJRJ3rUF7VPuDRPq5k6cqRpqYvOIHvjGPlU2gQ5SgusTXn3xfvcP0diP5F9I5itsOSikM2tSj0= test@example.com"
+    community_string          = "test-community"
+    management_subnet_id      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/management"
+    monitoring_subnet_id      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/monitoring"
+    fleet_token               = "test-fleet-token"
+    fleet_url                 = "https://fleet.example.com:1443/fleet/v1/internal/softsensor/websocket"
+    fleet_server_sslname      = "fleet.example.com"
+    storage_account_id        = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Storage/storageAccounts/testflowlogs"
+  }
+}
+
+run "verify_with_ssh_restrictions" {
+  command = plan
+
+  variables {
+    deployment_name                = "test-flow-sensor"
+    resource_group_name            = "test-rg"
+    corelight_sensor_image_id      = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Compute/images/corelight-sensor"
+    sensor_ssh_public_key          = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7vbqajDRbQ3S3IGxwpasfG+JOSGX3gfpTeMKJT0hZpBA3E3t2I9oo5f3D5tNMFfxOrBdNjFqQ3NzsswFpBKST5HToAWpzuoFCHQsgqxP1JruHp+bh3faCheNBsqMSvp5bDPTN5F2JTbsOateCRYjM3DDmvxqP+xEePhXoLnJWFLhfp8jmeXlKjqKqSfvLrhQgKJmr+NFI9q9bFv3dPnfXPIn+akE37dyhLMpWnqXiPuDjRoSVisWQq/RvPuTGlOtWJGnvpqpUl3kn3aBDwN0b0+F3u5HG0gyVwpJRV9mA0Gs9E4A5iN1l/LjW+5ZjHqO8g3bRqpLniwRBjFZjG0wjI7F0gWluKuQvGT9PI6AAV9XZPH3EQ4w3O8FgPpsqJ9s7+HqXXt4DNdT7xELhE9bPJjnuKlPLPBFkVTBPoZ2r0E3BVjF51wvG8AJRJ3rUF7VPuDRPq5k6cqRpqYvOIHvjGPlU2gQ5SgusTXn3xfvcP0diP5F9I5itsOSikM2tSj0= test@example.com"
+    community_string               = "test-community"
+    management_subnet_id           = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/management"
+    monitoring_subnet_id           = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/monitoring"
+    license_key                    = "test-license-key"
+    storage_account_id             = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test-rg/providers/Microsoft.Storage/storageAccounts/testflowlogs"
+    ssh_allow_cidrs                = ["10.0.0.0/8", "192.168.1.0/24"]
+    management_interface_public_ip = true
+  }
+}

examples/azure/flow-sensor/variables.tf

@@ -0,0 +1,99 @@
+variable "deployment_name" {
+  description = "Name prefix for all resources (used to avoid naming conflicts)"
+  type        = string
+  default     = "corelight-vnet-flow-sensor"
+}
+
+variable "location" {
+  description = "Azure region where resources will be deployed"
+  type        = string
+  default     = "eastus"
+}
+
+variable "resource_group_name" {
+  description = "The resource group where all resources will be deployed"
+  type        = string
+}
+
+variable "corelight_sensor_image_id" {
+  description = "The resource ID of the Corelight sensor image"
+  type        = string
+}
+
+variable "sensor_ssh_public_key" {
+  description = "SSH public key content for the sensor VM"
+  type        = string
+}
+
+variable "community_string" {
+  description = "Community string (API password) for sensor management"
+  type        = string
+  sensitive   = true
+}
+
+# Licensing (Choose ONE option)
+
+variable "license_key" {
+  description = "Corelight sensor license key. Optional if fleet_url is configured."
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "fleet_token" {
+  description = "Fleet pairing token from the Fleet UI"
+  type        = string
+  sensitive   = true
+  default     = ""
+}
+
+variable "fleet_url" {
+  description = "URL of the Fleet instance"
+  type        = string
+  default     = ""
+}
+
+variable "fleet_server_sslname" {
+  description = "SSL hostname for the Fleet server"
+  type        = string
+  default     = ""
+}
+
+# Network Configuration
+
+variable "management_subnet_id" {
+  description = "Subnet ID for the management network interface"
+  type        = string
+}
+
+variable "monitoring_subnet_id" {
+  description = "Subnet ID for the monitoring network interface"
+  type        = string
+}
+
+variable "management_interface_public_ip" {
+  description = "Whether to associate a public IP with the management interface"
+  type        = bool
+  default     = false
+}
+
+variable "ssh_allow_cidrs" {
+  description = "CIDR blocks allowed to SSH to the flow sensor"
+  type        = list(string)
+  default     = []
+}
+
+# VNet Flow Logs Configuration
+
+variable "storage_account_id" {
+  description = "The resource ID of the storage account containing VNet flow logs"
+  type        = string
+}
+
+# Tags
+
+variable "tags" {
+  description = "Tags to apply to all resources"
+  type        = map(string)
+  default     = {}
+}

examples/azure/flow-sensor/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.9.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 4.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+}