检查以下代码：

terraform {
      backend "azurerm" {
        resource_group_name  = "XXX"
        storage_account_name = "remteccc1"
        container_name       = "terraform"
        key                  = "terraform.tfstate"
      }
  }

resource "azurerm_log_analytics_workspace" "exm" {
  name                = "dsd"
 location                    = xx
  resource_group_name         = xxx
  sku                 = "PerGB2018"
  retention_in_days   = 90
}

resource "azurerm_log_analytics_solution" "log_analytics_solution_sentinel" {
  solution_name         = "SecurityInsights"
 location                    = data.azurerm_resource_group.example.location
  resource_group_name         = data.azurerm_resource_group.example.name
  workspace_resource_id = azurerm_log_analytics_workspace. exm.id
  workspace_name        = azurerm_log_analytics_workspace. exm.name
  plan {
    publisher = "Microsoft"
    product   = "OMSGallery/SecurityInsights"
  }
  depends_on = [azurerm_log_analytics_workspace.rgcore-management-la]

}

可以给予playbook的权限如下。

您需要拥有playbook的权限，我们可以将Microsoft Sentinel Automation Contributor角色等角色添加到允许访问sentinel的资源。

resource "azurerm_role_assignment" "sentinel_contributor" {
  scope              = "/subscriptions/<subId>/resourceGroups/<rg>"
 // role_definition_id = azurerm_role_definition.sentinelcontributor.id
  role_definition_name = "Azure Sentinel Contributor"
  principal_id       =  "3367a746-xxx18686"#objectid of azure security insights app objectId or servicepincipal 
data.azurerm_client_config.current.object_id
}

这些角色将分配给包含Microsoft Sentinel工作区的安全洞察或资源组。

使用权限，自动化规则被创建并反映在microsoft Sentinel下的门户中。

resource "azurerm_sentinel_automation_rule" "example" {
  name                       = "56094f72-ac3f-40e7-a0c0-47bd95f70336"
  log_analytics_workspace_id = azurerm_log_analytics_workspace.rgcore-management-la.id
  display_name               = "automation_rule1"
  order                      = 1
  action_incident {
    order  = 1
    status = "Active"
  }
}