# Elastic Defend Integration using Terraform

**URL:** <https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583>\
**Category:** Elastic Security\
**Created:** [August 27, 2024, 3:18am UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583 "2024-08-27T03:18:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![alextg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alextg/32/137075_2.png) [@alextg](https://discuss.elastic.co/u/alextg)\
**Post date:** [August 27, 2024, 3:18am UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583/1 "2024-08-27T03:18:05Z")

</div>

Hi,  
Working in creating an agent policy with 3 integrations using terraform, first 2 integrations are completed, however the defend integration is giving issues. Can someone correct/advise how to defined the defend integration in TF? See below the code which is not working.

```auto
resource "elasticstack_fleet_integration_policy" "fleet_defend_integration_policy" {
  name = endpoint_integrations"
  namespace = "my_namespace"
  description = "my_description"
  agent_policy_id = elasticstack_fleet_agent_policy.default_agent_policy.policy_id
  integration_name = elasticstack_fleet_integration.endpoint_integration.name
  integration_version = elasticstack_fleet_integration.endpoint_integration.version

  input {
    input_id = "endpoint"
    vars_json = jsonencode(
      {
          "config.integration_config.value": {
            "type": "endpoint", 
            "endpointConfig.preset": "EDRComplete"
          }
      }
    )

  }
}

```

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [August 27, 2024, 1:13pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583/2 "2024-08-27T13:13:24Z")

</div>

Which version are you deploying? Elastic Endpoint, the endpoint service for Elastic Defend has been deprecated for containers. You might be interested in the replacement product [Defend for Containers | Documentation (elastic.co)](https://www.elastic.co/docs/current/integrations/cloud_defend)

---

<div class="post-metadata">

**Author:** ![alextg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alextg/32/137075_2.png) [@alextg](https://discuss.elastic.co/u/alextg)\
**Post date:** [August 27, 2024, 3:07pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583/3 "2024-08-27T15:07:28Z")

</div>

Version is 8.14. Also, the terraform I'm building is not for containers, it just builds an agent policy with a defend integration.

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [August 27, 2024, 8:01pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583/4 "2024-08-27T20:01:43Z")

</div>

Thank you for the clarification, then I'll let others speak here as I'm not familiar with this area.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 27, 2024, 9:23pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583/5 "2024-08-27T21:23:32Z")

</div>

I think there is a misalignment in between the Terraform `fleet_integration_policy` parameters and the full scope of options supported by the Fleet API.

To resolve this we need to enhance the Terraform resource to allow for parameters like `config` and `type` to be specified. Would you want to open a request for that in [GitHub - elastic/terraform-provider-elasticstack: Terraform provider for Elastic Stack](https://github.com/elastic/terraform-provider-elasticstack) if there isn't already one?

### References

- Fleet API (see `POST /package_policies`): [MrinDoc OpenAPI Spec Viewer](https://mrin9.github.io/OpenAPI-Viewer/#/load/https%3A%2F%2Fraw.githubusercontent.com%2Felastic%2Fkibana%2Fmain%2Fx-pack%2Fplugins%2Ffleet%2Fcommon%2Fopenapi%2Fbundled.json)
- Terraform interface: [Terraform Registry](https://registry.terraform.io/providers/elastic/elasticstack/latest/docs/resources/fleet_integration_policy#nested-schema-for-input)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2024, 9:24pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-using-terraform/365583/6 "2024-09-24T21:24:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.