oci_vulnerability_scanning_host_scan_recipe
This resource provides the Host Scan Recipe resource in Oracle Cloud Infrastructure Vulnerability Scanning service.
Creates a new HostScanRecipe. A recipe determines the types of security issues that you want scanned, and how often to scan.
Example Usage
resource "oci_vulnerability_scanning_host_scan_recipe" "test_host_scan_recipe" {
#Required
agent_settings {
#Required
scan_level = var.host_scan_recipe_agent_settings_scan_level
#Optional
agent_configuration {
#Required
vendor = var.host_scan_recipe_agent_settings_agent_configuration_vendor
#Optional
cis_benchmark_settings {
#Optional
scan_level = var.host_scan_recipe_agent_settings_agent_configuration_cis_benchmark_settings_scan_level
}
endpoint_protection_settings {
#Optional
scan_level = var.host_scan_recipe_agent_settings_agent_configuration_endpoint_protection_settings_scan_level
}
should_un_install = var.host_scan_recipe_agent_settings_agent_configuration_should_un_install
vault_secret_id = oci_vault_secret.test_secret.id
vendor_type = var.host_scan_recipe_agent_settings_agent_configuration_vendor_type
}
}
compartment_id = var.compartment_id
port_settings {
#Required
scan_level = var.host_scan_recipe_port_settings_scan_level
}
schedule {
#Required
type = var.host_scan_recipe_schedule_type
#Optional
day_of_week = var.host_scan_recipe_schedule_day_of_week
}
#Optional
application_settings {
#Required
application_scan_recurrence = var.host_scan_recipe_application_settings_application_scan_recurrence
folders_to_scan {
#Required
folder = var.host_scan_recipe_application_settings_folders_to_scan_folder
operatingsystem = var.host_scan_recipe_application_settings_folders_to_scan_operatingsystem
}
is_enabled = var.host_scan_recipe_application_settings_is_enabled
}
defined_tags = {"foo-namespace.bar-key"= "value"}
display_name = var.host_scan_recipe_display_name
freeform_tags = {"bar-key"= "value"}
}
Argument Reference
The following arguments are supported:
agent_settings
- (Required) (Updatable) Agent scan settings for a host scanagent_configuration
- (Optional) (Updatable) Agent configuration for host scan agent settings. This model is polymorphic, presenting different configuration options based on selected agent vendor.cis_benchmark_settings
- (Applicable when vendor=OCI) (Updatable) CIS (Center for Internet Security) Benchmark scan settings for a host scanscan_level
- (Applicable when vendor=OCI) (Updatable) The level of strictness to apply for CIS Benchmarks. Use ‘NONE’ to disable CIS Benchmark checks entirely.
endpoint_protection_settings
- (Applicable when vendor=OCI) (Updatable) Endpoint Protection scan settings for a host scanscan_level
- (Applicable when vendor=OCI) (Updatable) The scan level. Use ‘NONE’ to disable Endpoint Protection checks entirely.
should_un_install
- (Required when vendor=QUALYS) (Updatable) Boolean flag letting agent know if it should un-install the Qualys agent when it is stopped.vault_secret_id
- (Required when vendor=QUALYS) (Updatable) Vault secret OCID which stores license information. Content inside this secret in vault would be base64 string containing information about customer’s Qualys susbcription license.vendor
- (Required) (Updatable) Vendor to use for the host scan agent.vendor_type
- (Optional) (Updatable) Vendor to use for the host scan agent.
scan_level
- (Required) (Updatable) The scan level
application_settings
- (Optional) (Updatable) Agent scan settings for an application scan (as a part of a host scan)application_scan_recurrence
- (Required) (Updatable) Scan recurrences in RFC-5545 section 3.3.10 format. Only supported input are weekly, biweekly, monthly listed below FREQ=WEEKLY;WKST=;INTERVAL=1 - This weekly scan on the specified weekday (e.g. SU for Sunday) FREQ=WEEKLY;WKST= ;INTERVAL=2 - This bi-weekly scan on the specified weekday (e.g. SU for Sunday) FREQ=MONTHLY;WKST= ;INTERVAL=1 - This monthly scan on the specified weekday (e.g. SU for Sunday, starting from the next such weekday based on the time of setting creation) folders_to_scan
- (Required) (Updatable) List of folders selected for scanningfolder
- (Required) (Updatable) Folder to be scanned in the corresponding operating systemoperatingsystem
- (Required) (Updatable) Operating system type
is_enabled
- (Required) (Updatable) Enable or disable application scan
compartment_id
- (Required) (Updatable) Compartment ID of the scanning config. If no individual hosts are specified, all hosts in this compartment are scanneddefined_tags
- (Optional) (Updatable) Defined tags for this resource. Each key is predefined and scoped to a namespace. Example:{"foo-namespace.bar-key": "value"}
display_name
- (Optional) (Updatable) Recipe identifier, which can be renamed. If not present, it will be auto-generated. Avoid entering confidential information.freeform_tags
- (Optional) (Updatable) Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. Example:{"bar-key": "value"}
port_settings
- (Required) (Updatable) Port scan settings for a host scanscan_level
- (Required) (Updatable) The scan level
schedule
- (Required) (Updatable) A scanning scheduleday_of_week
- (Optional) (Updatable) Day of week the scheduled scan occurs (not applicable for DAILY type)type
- (Required) (Updatable) How often the scan occurs
** IMPORTANT ** Any change to a property that does not support update will force the destruction and recreation of the resource with the new property values
Attributes Reference
The following attributes are exported:
agent_settings
- Agent scan settings for a host scanagent_configuration
- Agent configuration for host scan agent settings. This model is polymorphic, presenting different configuration options based on selected agent vendor.cis_benchmark_settings
- CIS (Center for Internet Security) Benchmark scan settings for a host scanscan_level
- The level of strictness to apply for CIS Benchmarks. Use ‘NONE’ to disable CIS Benchmark checks entirely.
endpoint_protection_settings
- Endpoint Protection scan settings for a host scanscan_level
- The scan level. Use ‘NONE’ to disable Endpoint Protection checks entirely.
should_un_install
- Boolean flag letting agent know if it should un-install the Qualys agent when it is stopped.vault_secret_id
- Vault secret OCID which stores license information. Content inside this secret in vault would be base64 string containing information about customer’s Qualys susbcription license.vendor
- Vendor to use for the host scan agent.vendor_type
- Vendor to use for the host scan agent.
scan_level
- The scan level
application_settings
- Agent scan settings for applicaiton scanapplication_scan_recurrence
- Scan recurrences in RFC-5545 section 3.3.10 format. Only supported input are weekly, biweekly, monthly listed below FREQ=WEEKLY;WKST=;INTERVAL=1 - This weekly scan on the specified weekday (e.g. Sunday) FREQ=WEEKLY;WKST= ;INTERVAL=2 - This bi-weekly scan on the specified weekday (e.g. Sunday) FREQ=MONTHLY;WKST= ;INTERVAL=1 - This monthly scan on the specified weekday (e.g. Sunday, starting from the next such weekday based on the time of setting creation) folders_to_scan
- List of folders selected for scanningfolder
- Folder to be scanned in the corresponding operating systemoperatingsystem
- Operating system type
is_enabled
- Enable or disable application scan
compartment_id
- Compartment ID of the scan recipedefined_tags
- Defined tags for this resource. Each key is predefined and scoped to a namespace. Example:{"foo-namespace.bar-key": "value"}
display_name
- Recipe identifier, which can be renamedfreeform_tags
- Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. Example:{"bar-key": "value"}
id
- Unique identifier of the config that is immutable on creationport_settings
- Port scan settings for a host scanscan_level
- The scan level
schedule
- A scanning scheduleday_of_week
- Day of week the scheduled scan occurs (not applicable for DAILY type)type
- How often the scan occurs
state
- The current state of the config.system_tags
- Usage of system tag keys. These predefined keys are scoped to namespaces. Example:{"orcl-cloud.free-tier-retained": "true"}
time_created
- Date and time the recipe was created, format as described in RFC 3339time_updated
- Date and time the recipe was last updated, format as described in RFC 3339
Timeouts
The timeouts
block allows you to specify timeouts for certain operations:
* create
- (Defaults to 20 minutes), when creating the Host Scan Recipe
* update
- (Defaults to 20 minutes), when updating the Host Scan Recipe
* delete
- (Defaults to 20 minutes), when destroying the Host Scan Recipe
Import
HostScanRecipes can be imported using the id
, e.g.
$ terraform import oci_vulnerability_scanning_host_scan_recipe.test_host_scan_recipe "id"