Technical Tip: FortiCNAPP DSPM Azure Integration Setup
| Description | This article describes how to configure Data Security Posture Management (DSPM) integration for Microsoft Azure in a FortiCNAPP account using Terraform. The content covers provider configuration, required module calls, deployment, and a basic validation flow. |
| Scope |
|
| Solution | Prerequisites
Provider and module configuration. Use the following content in main.tf:
# ============================================================================= # FortiCNAPP DSPM Azure Integration - Fully Automated # ============================================================================= terraform { required_version = ">= 1.9" required_providers { azurerm = { source = "hashicorp/azurerm" version = ">= 3.80" } lacework = { source = "lacework/lacework" version = "~> 2.3" } } } provider "azurerm" { features { key_vault { purge_soft_delete_on_destroy = true recover_soft_deleted_key_vaults = true } } } provider "lacework" { account = var.lacework_account api_key = var.lacework_api_key api_secret = var.lacework_api_secret } # ── Step 1: Create Service Principal with Required Permissions ────────────── module "dspm_service_principal" { source = "lacework/dspm/azure//service_principal" version = "~> 0.2" service_principal_name = "forticnapp-dspm-deployment-sp" scanning_subscription_id = var.scanning_subscription_id client_secret_expiry_duration_hours = "4380h" # ~6 months } # ── Step 2: Deploy DSPM Infrastructure Using Created Service Principal ────── module "lacework_azure_dspm" { source = "lacework/dspm/azure" version = "~> 0.2" lacework_integration_name = var.lacework_integration_name regions = var.regions scanning_subscription_id = var.scanning_subscription_id tenant_id = var.tenant_id resource_prefix = var.resource_prefix owner_id = module.dspm_service_principal.service_principal_object_id # Scanner Configuration scan_frequency_hours = var.scan_frequency_hours max_file_size_mb = var.max_file_size_mb # Datastore Filtering datastore_filters = var.datastore_filters tags = var.tags }
Create variables.tf and terraform.tfvars. Example variables for terraform.tfvars: scanning_subscription_id = "<azure-subscription-id>" tenant_id = "<azure-tenant-id>" regions = ["East US"] lacework_account = "<forticnapp-account>.lacework.net" lacework_api_key = "<forticnapp-api-key>" lacework_api_secret = "<forticnapp-api-secret>" lacework_integration_name = "azure-dspm" resource_prefix = "forticnapp" scan_frequency_hours = 24 max_file_size_mb = 20 datastore_filters = [] tags = { Environment = "production" ManagedBy = "terraform" } Deploy the integration: Run the following commands in the Terraform working directory:
terraform init
Basic integration test:
After applying, validate the integration with the following checks:
|
