````plaintext
## Terraform Configuration

```hcl
# main.tf - Microsoft Defender for Cloud Configuration
# Enables Defender plans for comprehensive security posture management
# and vulnerability scanning across Azure resources
#
# FedRAMP 20x KSI Alignment:
# - KSI-AFR-01: Vulnerability scanning and asset discovery
# - KSI-AFR-04: Vulnerability detection and remediation tracking
# - KSI-AFR-06: Continuous security assessments
# - KSI-AFR-07: Security posture and secure score monitoring
# - KSI-AFR-09: Compliance dashboard and regulatory mapping
# - KSI-AFR-11: Cryptographic module recommendations
# - KSI-PIY-01: Automated inventory (real-time asset tracking)
# - KSI-PIY-05: Evaluate implementations (security evaluation)
# - KSI-PIY-06: Security investment effectiveness metrics
# - KSI-PIY-07: Supply chain risk management
# - KSI-PIY-08: Executive support (engagement metrics)
# - KSI-TPR-04: Supply chain risk monitoring

terraform {
  required_version = ">= 1.0"
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

# Variables
variable "defender_email_contact" {
  description = "Email address for security alerts"
  type        = string
}

variable "defender_phone_contact" {
  description = "Phone number for security alerts (optional)"
  type        = string
  default     = ""
}

variable "log_analytics_workspace_id" {
  description = "Resource ID of the Log Analytics workspace for Defender data"
  type        = string
}

variable "subscription_id" {
  description = "Azure subscription ID"
  type        = string
}

# Security contact configuration
resource "azurerm_security_center_contact" "main" {
  email               = var.defender_email_contact
  phone               = var.defender_phone_contact
  alert_notifications = true
  alerts_to_admins    = true
}

# Enable Defender for Servers (VMs and VM Scale Sets)
# Supports: KSI-AFR-01 (vulnerability scanning), KSI-AFR-04 (vulnerability detection)
resource "azurerm_security_center_subscription_pricing" "virtual_machines" {
  tier          = "Standard"
  resource_type = "VirtualMachines"
  subplan       = "P2" # P2 includes vulnerability assessment, JIT access, file integrity monitoring
}

# Enable Defender for App Service
resource "azurerm_security_center_subscription_pricing" "app_services" {
  tier          = "Standard"
  resource_type = "AppServices"
}

# Enable Defender for Azure SQL Databases
resource "azurerm_security_center_subscription_pricing" "sql_servers" {
  tier          = "Standard"
  resource_type = "SqlServers"
}

# Enable Defender for SQL Servers on VMs
resource "azurerm_security_center_subscription_pricing" "sql_server_vms" {
  tier          = "Standard"
  resource_type = "SqlServerVirtualMachines"
}

# Enable Defender for Open-Source Relational Databases
resource "azurerm_security_center_subscription_pricing" "oss_databases" {
  tier          = "Standard"
  resource_type = "OpenSourceRelationalDatabases"
}

# Enable Defender for Storage
# Supports: KSI-AFR-01 (asset discovery), KSI-PIY-01 (automated inventory)
resource "azurerm_security_center_subscription_pricing" "storage_accounts" {
  tier          = "Standard"
  resource_type = "StorageAccounts"
  
  extension {
    name = "OnUploadMalwareScanning"
    additional_extension_properties = {
      CapGBPerMonthPerStorageAccount = "5000"
    }
  }
  
  extension {
    name = "SensitiveDataDiscovery"
  }
}

# Enable Defender for Containers (AKS, ACR, running containers)
# Supports: KSI-AFR-01 (container vulnerability scanning), KSI-TPR-04 (supply chain monitoring)
resource "azurerm_security_center_subscription_pricing" "containers" {
  tier          = "Standard"
  resource_type = "Containers"
  
  extension {
    name = "ContainerRegistriesVulnerabilityAssessments"
  }
}

# Enable Defender for Key Vault
resource "azurerm_security_center_subscription_pricing" "key_vaults" {
  tier          = "Standard"
  resource_type = "KeyVaults"
}

# Enable Defender for Resource Manager
resource "azurerm_security_center_subscription_pricing" "arm" {
  tier          = "Standard"
  resource_type = "Arm"
}

# Enable Defender for DNS
resource "azurerm_security_center_subscription_pricing" "dns" {
  tier          = "Standard"
  resource_type = "Dns"
}

# Enable Defender for Cosmos DB
resource "azurerm_security_center_subscription_pricing" "cosmos_db" {
  tier          = "Standard"
  resource_type = "CosmosDbs"
}

# Auto-provisioning settings - Deploy Log Analytics agent to VMs
resource "azurerm_security_center_auto_provisioning" "main" {
  auto_provision = "On"
}

# Link to Log Analytics workspace for Defender data collection
resource "azurerm_security_center_workspace" "main" {
  scope        = "/subscriptions/${var.subscription_id}"
  workspace_id = var.log_analytics_workspace_id
}

# Outputs
output "security_contact_id" {
  description = "ID of the security contact"
  value       = azurerm_security_center_contact.main.id
}

output "defender_plans_enabled" {
  description = "List of enabled Defender plans"
  value = [
    "VirtualMachines",
    "AppServices",
    "SqlServers",
    "SqlServerVirtualMachines",
    "OpenSourceRelationalDatabases",
    "StorageAccounts",
    "Containers",
    "KeyVaults",
    "Arm",
    "Dns",
    "CosmosDbs"
  ]
}
```

## Usage Notes

**FedRAMP Alignment:**
- Enables Defender across ~8-10 KSIs (AFR, PIY, TPR families)
- Supports automated vulnerability scanning (KSI-AFR-01, KSI-AFR-04)
- Enables security posture management (KSI-PIY-01, KSI-TPR-04)
- Provides compliance dashboards for evidence collection

**Deployment:**
```bash
# Create terraform.tfvars
cat > terraform.tfvars <<EOF
defender_email_contact = "security@example.com"
defender_phone_contact = "+1-555-0100"
subscription_id = "00000000-0000-0000-0000-000000000000"
log_analytics_workspace_id = "/subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}"
EOF

# Initialize and apply
terraform init
terraform plan
terraform apply
```

**Cost Considerations:**
- Defender for Cloud pricing is per-resource: https://azure.microsoft.com/pricing/details/defender-for-cloud/
- Typical costs: $15/server/month, $10/app service/month, $15/SQL server/month
- Storage: $10/storage account/month + $0.15/GB scanned
- Containers: $7/vCore/month for AKS

**Alternative Tools:**
If not using Defender for Cloud, consider:
- **Qualys** or **Tenable** for vulnerability scanning
- **Azure Policy** for compliance monitoring
- **Azure Resource Graph** for inventory management
- **Trivy** or **Snyk** for container scanning

**Required Permissions:**
- `Security Admin` role on subscription
- `Owner` or `Contributor` + `Security Admin` for full configuration

````
