feat: add Azure Agentless support in generate command

cli/cmd/generate_azure.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"fmt"
 	"regexp"
 	"strconv"
 	"strings"
@@ -16,15 +17,17 @@ import (
 
 // Question labels
 const (
-	IconAzureConfig = "[Configuration]"
-	IconActivityLog = "[Activity Log]"
-	IconEntraID     = "[Entra ID Activity Log]"
-	IconAD          = "[Active Directory Application]"
+	IconAzureConfig    = "[Configuration]"
+	IconActivityLog    = "[Activity Log]"
+	IconEntraID        = "[Entra ID Activity Log]"
+	IconAD             = "[Active Directory Application]"
+	IconAzureAgentless = "[Agentless]"
 )
 
 var (
 	// Define question text here so they can be reused in testing
 	// Core questions
+	QuestionAzureEnableAgentless     = "Enable Agentless integration?"
 	QuestionAzureEnableConfig        = "Enable Configuration integration?"
 	QuestionAzureConfigName          = "Custom Configuration integration name: (optional)"
 	QuestionEnableActivityLog        = "Enable Activity Log Integration?"
@@ -196,8 +199,19 @@ the new cloud account. In interactive mode, this command will:
 				azure.WithEventHubPartitionCount(GenerateAzureCommandState.EventHubPartitionCount),
 			}
 
+			if GenerateAzureCommandState.Agentless {
+				mods = append(mods, azure.WithIntegrationLevel(GenerateAzureCommandState.IntegrationLevel))
+				mods = append(mods, azure.WithAgentlessSubscriptionIds(GenerateAzureCommandState.AgentlessSubscriptionIds))
+				mods = append(mods, azure.WithRegions(GenerateAzureCommandState.Regions))
+				mods = append(mods, azure.WithCreateLogAnalyticsWorkspace(GenerateAzureCommandState.CreateLogAnalyticsWorkspace))
+				mods = append(mods, azure.WithGlobal(GenerateAzureCommandState.Global))
+			}
+
 			// Check if AD Creation is required, need to set values for current integration
-			if !GenerateAzureCommandState.CreateAdIntegration {
+			if !GenerateAzureCommandState.CreateAdIntegration &&
+				(GenerateAzureCommandState.Config ||
+					GenerateAzureCommandState.ActivityLog ||
+					GenerateAzureCommandState.EntraIdActivityLog) {
 				mods = append(mods, azure.WithAdApplicationId(GenerateAzureCommandState.AdApplicationId))
 				mods = append(mods, azure.WithAdApplicationPassword(GenerateAzureCommandState.AdApplicationPassword))
 				mods = append(mods, azure.WithAdServicePrincipalId(GenerateAzureCommandState.AdServicePrincipalId))
@@ -225,6 +239,7 @@ the new cloud account. In interactive mode, this command will:
 			data := azure.NewTerraform(
 				GenerateAzureCommandState.Config,
 				GenerateAzureCommandState.ActivityLog,
+				GenerateAzureCommandState.Agentless,
 				GenerateAzureCommandState.EntraIdActivityLog,
 				GenerateAzureCommandState.CreateAdIntegration,
 				mods...)
@@ -391,6 +406,30 @@ func initGenerateAzureTfCommandFlags() {
 		"",
 		"specify a custom activity log integration name")
 
+	generateAzureTfCommand.PersistentFlags().BoolVar(
+		&GenerateAzureCommandState.Agentless,
+		"agentless",
+		false,
+		"enable agentless integration")
+
+	generateAzureTfCommand.PersistentFlags().StringVar(
+		&GenerateAzureCommandState.IntegrationLevel,
+		"integration_level",
+		"",
+		"specify the agentless integration level (e.g., 'SUBSCRIPTION', 'TENANT')")
+
+	generateAzureTfCommand.PersistentFlags().BoolVar(
+		&GenerateAzureCommandState.Global,
+		"global",
+		true,
+		"enable global agentless scanning")
+
+	generateAzureTfCommand.PersistentFlags().BoolVar(
+		&GenerateAzureCommandState.CreateLogAnalyticsWorkspace,
+		"create_log_analytics_workspace",
+		false,
+		"enable creation of Log Analytics Workspace for agentless scanning")
+
 	generateAzureTfCommand.PersistentFlags().BoolVar(
 		&GenerateAzureCommandState.EntraIdActivityLog,
 		"entra_id_activity_log",
@@ -756,6 +795,25 @@ func promptAzureGenerate(
 		}
 	}
 
+	// Ask Agentless integration
+	if err := SurveyMultipleQuestionWithValidation(
+		[]SurveyQuestionWithValidationArgs{
+			{
+				Icon:     IconAzureAgentless,
+				Prompt:   &survey.Confirm{Message: QuestionAzureEnableAgentless, Default: config.Agentless},
+				Response: &config.Agentless,
+			},
+		}); err != nil {
+		return err
+	}
+
+	// Ask Activity Log questions immediately if enabled
+	if config.Agentless {
+		if err := promptAzureAgentlessQuestions(config); err != nil {
+			return err
+		}
+	}
+
 	// Ask Entra ID integration
 	if err := SurveyMultipleQuestionWithValidation(
 		[]SurveyQuestionWithValidationArgs{
@@ -776,27 +834,33 @@ func promptAzureGenerate(
 	}
 
 	// Validate one of config or activity log was enabled; otherwise error out
-	if !config.Config && !config.ActivityLog && !config.EntraIdActivityLog {
-		return errors.New("must enable at least one of: Configuration or Activity Log integration")
+	if !config.Config && !config.ActivityLog && !config.Agentless && !config.EntraIdActivityLog {
+		return errors.New("must enable at least one of: Configuration, Agentless or Activity Log integrations")
 	}
 
 	// Ask AD integration
-	if err := SurveyMultipleQuestionWithValidation(
-		[]SurveyQuestionWithValidationArgs{
-			{
-				Icon:     IconAD,
-				Prompt:   &survey.Confirm{Message: QuestionEnableAdIntegration, Default: config.CreateAdIntegration},
-				Response: &config.CreateAdIntegration,
-			},
-		}); err != nil {
-		return err
-	}
-
-	// If AD integration is not being created, ask for existing AD details immediately
-	if !config.CreateAdIntegration {
-		if err := promptAzureAdIntegrationQuestions(config); err != nil {
+	if config.Config || config.ActivityLog || config.EntraIdActivityLog {
+		if err := SurveyMultipleQuestionWithValidation(
+			[]SurveyQuestionWithValidationArgs{
+				{
+					Icon:     IconAD,
+					Prompt:   &survey.Confirm{Message: QuestionEnableAdIntegration, Default: config.CreateAdIntegration},
+					Response: &config.CreateAdIntegration,
+				},
+			}); err != nil {
 			return err
 		}
+
+		// If AD integration is not being created, ask for existing AD details immediately
+		if !config.CreateAdIntegration {
+			if err := promptAzureAdIntegrationQuestions(config); err != nil {
+				return err
+			}
+		}
+	}
+	// for agentless only scenario, we set CreateAdIntegration to false
+	if config.Agentless && !config.Config && !config.ActivityLog && !config.EntraIdActivityLog {
+		config.CreateAdIntegration = false
 	}
 
 	// Ask about output location
@@ -890,3 +954,100 @@ func promptAzureActivityLogQuestions(config *azure.GenerateAzureTfConfigurationA
 
 	return nil
 }
+
+func promptAzureAgentlessQuestions(config *azure.GenerateAzureTfConfigurationArgs) error {
+	// Prompt for integration level(SUBSCRIPTION or TENANT)
+	if config.IntegrationLevel == "" {
+		config.IntegrationLevel = "SUBSCRIPTION"
+	}
+	if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
+		{
+			Icon: IconAzureAgentless,
+			Prompt: &survey.Select{
+				Message: "Select integration level:",
+				Options: []string{"SUBSCRIPTION", "TENANT"},
+				Default: config.IntegrationLevel,
+			},
+			Response: &config.IntegrationLevel,
+		},
+	}); err != nil {
+		return err
+	}
+
+	// prompt for global setting
+	if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
+		{
+			Icon:     IconAzureAgentless,
+			Prompt:   &survey.Confirm{Message: "Enable global agentless scanning?", Default: config.Global},
+			Response: &config.Global,
+		},
+	}); err != nil {
+		return err
+	}
+
+	// prompt for log analytics workspace creation (default: false)
+	if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
+		{
+			Icon:     IconAzureAgentless,
+			Prompt:   &survey.Confirm{Message: "Create Log Analytics Workspace?", Default: config.CreateLogAnalyticsWorkspace},
+			Response: &config.CreateLogAnalyticsWorkspace,
+		},
+	}); err != nil {
+		return err
+	}
+
+	// Ask for regions
+	var regionsInput string
+	if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
+		{
+			Icon: IconAzureAgentless,
+			Prompt: &survey.Input{
+				Message: "Comma-separated list of regions for Agentless scanning (e.g., 'East US, West US')",
+				Default: "West US",
+			},
+			Response: &regionsInput,
+		},
+	}); err != nil {
+		return err
+	}
+	// parse regions from comma-separated string
+	if regionsInput != "" {
+		regions := strings.Split(regionsInput, ",")
+		for i, region := range regions {
+			regions[i] = strings.TrimSpace(region)
+		}
+		config.Regions = regions
+	}
+
+	// Only ask for subscription IDs if SUBSCRIPTION integration level is selected
+	if config.IntegrationLevel == "SUBSCRIPTION" {
+		var subscriptionIdsInput string
+		for {
+			if err := SurveyMultipleQuestionWithValidation([]SurveyQuestionWithValidationArgs{
+				{
+					Icon: IconAzureAgentless,
+					Prompt: &survey.Input{
+						Message: "Comma-separated list of subscription IDs for Agentless scanning (e.g., 'sub1, sub2')",
+						Default: "",
+					},
+					Response: &subscriptionIdsInput,
+				},
+			}); err != nil {
+				return err
+			}
+			subscriptionIdsInput = strings.TrimSpace(subscriptionIdsInput)
+			if subscriptionIdsInput != "" {
+				subscriptionIds := strings.Split(subscriptionIdsInput, ",")
+				for i, subId := range subscriptionIds {
+					subscriptionIds[i] = strings.TrimSpace(subId)
+				}
+				config.AgentlessSubscriptionIds = subscriptionIds
+				break
+			} else {
+				fmt.Println("Subscription IDs cannot be empty. Please provide at least one subscription ID.")
+			}
+
+		}
+	}
+	return nil
+}

cli/cmd/generate_azure_test.go

@@ -39,10 +39,11 @@ func TestMissingValidEntity(t *testing.T) {
 	data := azure.GenerateAzureTfConfigurationArgs{}
 	data.Config = false
 	data.ActivityLog = false
+	data.Agentless = false
 
 	err := promptAzureGenerate(&data, &AzureGenerateCommandExtraState{Output: "/tmp"})
 	assert.Error(t, err)
-	assert.Equal(t, "must enable at least one of: Configuration or Activity Log integration", err.Error())
+	assert.Equal(t, "must enable at least one of: Configuration, Agentless or Activity Log integrations", err.Error())
 }
 
 func TestValidStorageLocations(t *testing.T) {