1. Packages
  2. Azure Native
  3. API Docs
  4. security
  5. CustomRecommendation
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.13.0 published on Wednesday, Jan 28, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azure-native

azure-native.security.CustomRecommendation

azure-native logo
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.13.0 published on Wednesday, Jan 28, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-azure-native

    Custom Recommendation

    Uses Azure REST API version 2024-08-01. In version 2.x of the Azure Native provider, it used API version 2024-08-01.

    Example Usage

    Create or update custom recommendation over management group scope

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var customRecommendation = new AzureNative.Security.CustomRecommendation("customRecommendation", new()
    {
        CloudProviders = new[]
        {
            AzureNative.Security.RecommendationSupportedClouds.AWS,
        },
        CustomRecommendationName = "33e7cc6e-a139-4723-a0e5-76993aee0771",
        Description = "organization passwords policy",
        DisplayName = "Password Policy",
        Query = "RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
        RemediationDescription = "Change password policy to...",
        Scope = "providers/Microsoft.Management/managementGroups/contoso",
        SecurityIssue = AzureNative.Security.SecurityIssue.Vulnerability,
        Severity = AzureNative.Security.SeverityEnum.Medium,
    });

});

    package main

import (
	security "github.com/pulumi/pulumi-azure-native-sdk/security/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := security.NewCustomRecommendation(ctx, "customRecommendation", &security.CustomRecommendationArgs{
			CloudProviders: pulumi.StringArray{
				pulumi.String(security.RecommendationSupportedCloudsAWS),
			},
			CustomRecommendationName: pulumi.String("33e7cc6e-a139-4723-a0e5-76993aee0771"),
			Description:              pulumi.String("organization passwords policy"),
			DisplayName:              pulumi.String("Password Policy"),
			Query:                    pulumi.String("RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')"),
			RemediationDescription:   pulumi.String("Change password policy to..."),
			Scope:                    pulumi.String("providers/Microsoft.Management/managementGroups/contoso"),
			SecurityIssue:            pulumi.String(security.SecurityIssueVulnerability),
			Severity:                 pulumi.String(security.SeverityEnumMedium),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.security.CustomRecommendation;
import com.pulumi.azurenative.security.CustomRecommendationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var customRecommendation = new CustomRecommendation("customRecommendation", CustomRecommendationArgs.builder()
            .cloudProviders("AWS")
            .customRecommendationName("33e7cc6e-a139-4723-a0e5-76993aee0771")
            .description("organization passwords policy")
            .displayName("Password Policy")
            .query("RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')")
            .remediationDescription("Change password policy to...")
            .scope("providers/Microsoft.Management/managementGroups/contoso")
            .securityIssue("Vulnerability")
            .severity("Medium")
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const customRecommendation = new azure_native.security.CustomRecommendation("customRecommendation", {
    cloudProviders: [azure_native.security.RecommendationSupportedClouds.AWS],
    customRecommendationName: "33e7cc6e-a139-4723-a0e5-76993aee0771",
    description: "organization passwords policy",
    displayName: "Password Policy",
    query: "RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
    remediationDescription: "Change password policy to...",
    scope: "providers/Microsoft.Management/managementGroups/contoso",
    securityIssue: azure_native.security.SecurityIssue.Vulnerability,
    severity: azure_native.security.SeverityEnum.Medium,
});

    import pulumi
import pulumi_azure_native as azure_native

custom_recommendation = azure_native.security.CustomRecommendation("customRecommendation",
    cloud_providers=[azure_native.security.RecommendationSupportedClouds.AWS],
    custom_recommendation_name="33e7cc6e-a139-4723-a0e5-76993aee0771",
    description="organization passwords policy",
    display_name="Password Policy",
    query="RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
    remediation_description="Change password policy to...",
    scope="providers/Microsoft.Management/managementGroups/contoso",
    security_issue=azure_native.security.SecurityIssue.VULNERABILITY,
    severity=azure_native.security.SeverityEnum.MEDIUM)

    resources:
  customRecommendation:
    type: azure-native:security:CustomRecommendation
    properties:
      cloudProviders:
        - AWS
      customRecommendationName: 33e7cc6e-a139-4723-a0e5-76993aee0771
      description: organization passwords policy
      displayName: Password Policy
      query: RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')
      remediationDescription: Change password policy to...
      scope: providers/Microsoft.Management/managementGroups/contoso
      securityIssue: Vulnerability
      severity: Medium

    Create or update custom recommendation over security connector scope

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var customRecommendation = new AzureNative.Security.CustomRecommendation("customRecommendation", new()
    {
        CloudProviders = new[]
        {
            AzureNative.Security.RecommendationSupportedClouds.AWS,
        },
        CustomRecommendationName = "33e7cc6e-a139-4723-a0e5-76993aee0771",
        Description = "organization passwords policy",
        DisplayName = "Password Policy",
        Query = "RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
        RemediationDescription = "Change password policy to...",
        Scope = "subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/gcpResourceGroup/providers/Microsoft.Security/securityConnectors/gcpconnector",
        SecurityIssue = AzureNative.Security.SecurityIssue.Vulnerability,
        Severity = AzureNative.Security.SeverityEnum.Medium,
    });

});

    package main

import (
	security "github.com/pulumi/pulumi-azure-native-sdk/security/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := security.NewCustomRecommendation(ctx, "customRecommendation", &security.CustomRecommendationArgs{
			CloudProviders: pulumi.StringArray{
				pulumi.String(security.RecommendationSupportedCloudsAWS),
			},
			CustomRecommendationName: pulumi.String("33e7cc6e-a139-4723-a0e5-76993aee0771"),
			Description:              pulumi.String("organization passwords policy"),
			DisplayName:              pulumi.String("Password Policy"),
			Query:                    pulumi.String("RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')"),
			RemediationDescription:   pulumi.String("Change password policy to..."),
			Scope:                    pulumi.String("subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/gcpResourceGroup/providers/Microsoft.Security/securityConnectors/gcpconnector"),
			SecurityIssue:            pulumi.String(security.SecurityIssueVulnerability),
			Severity:                 pulumi.String(security.SeverityEnumMedium),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.security.CustomRecommendation;
import com.pulumi.azurenative.security.CustomRecommendationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var customRecommendation = new CustomRecommendation("customRecommendation", CustomRecommendationArgs.builder()
            .cloudProviders("AWS")
            .customRecommendationName("33e7cc6e-a139-4723-a0e5-76993aee0771")
            .description("organization passwords policy")
            .displayName("Password Policy")
            .query("RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')")
            .remediationDescription("Change password policy to...")
            .scope("subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/gcpResourceGroup/providers/Microsoft.Security/securityConnectors/gcpconnector")
            .securityIssue("Vulnerability")
            .severity("Medium")
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const customRecommendation = new azure_native.security.CustomRecommendation("customRecommendation", {
    cloudProviders: [azure_native.security.RecommendationSupportedClouds.AWS],
    customRecommendationName: "33e7cc6e-a139-4723-a0e5-76993aee0771",
    description: "organization passwords policy",
    displayName: "Password Policy",
    query: "RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
    remediationDescription: "Change password policy to...",
    scope: "subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/gcpResourceGroup/providers/Microsoft.Security/securityConnectors/gcpconnector",
    securityIssue: azure_native.security.SecurityIssue.Vulnerability,
    severity: azure_native.security.SeverityEnum.Medium,
});

    import pulumi
import pulumi_azure_native as azure_native

custom_recommendation = azure_native.security.CustomRecommendation("customRecommendation",
    cloud_providers=[azure_native.security.RecommendationSupportedClouds.AWS],
    custom_recommendation_name="33e7cc6e-a139-4723-a0e5-76993aee0771",
    description="organization passwords policy",
    display_name="Password Policy",
    query="RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
    remediation_description="Change password policy to...",
    scope="subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/gcpResourceGroup/providers/Microsoft.Security/securityConnectors/gcpconnector",
    security_issue=azure_native.security.SecurityIssue.VULNERABILITY,
    severity=azure_native.security.SeverityEnum.MEDIUM)

    resources:
  customRecommendation:
    type: azure-native:security:CustomRecommendation
    properties:
      cloudProviders:
        - AWS
      customRecommendationName: 33e7cc6e-a139-4723-a0e5-76993aee0771
      description: organization passwords policy
      displayName: Password Policy
      query: RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')
      remediationDescription: Change password policy to...
      scope: subscriptions/20ff7fc3-e762-44dd-bd96-b71116dcdc23/resourceGroups/gcpResourceGroup/providers/Microsoft.Security/securityConnectors/gcpconnector
      securityIssue: Vulnerability
      severity: Medium

    Create or update custom recommendation over subscription scope

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var customRecommendation = new AzureNative.Security.CustomRecommendation("customRecommendation", new()
    {
        CloudProviders = new[]
        {
            AzureNative.Security.RecommendationSupportedClouds.AWS,
        },
        CustomRecommendationName = "33e7cc6e-a139-4723-a0e5-76993aee0771",
        Description = "organization passwords policy",
        DisplayName = "Password Policy",
        Query = "RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
        RemediationDescription = "Change password policy to...",
        Scope = "subscriptions/e5d1b86c-3051-44d5-8802-aa65d45a279b",
        SecurityIssue = AzureNative.Security.SecurityIssue.Vulnerability,
        Severity = AzureNative.Security.SeverityEnum.Medium,
    });

});

    package main

import (
	security "github.com/pulumi/pulumi-azure-native-sdk/security/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := security.NewCustomRecommendation(ctx, "customRecommendation", &security.CustomRecommendationArgs{
			CloudProviders: pulumi.StringArray{
				pulumi.String(security.RecommendationSupportedCloudsAWS),
			},
			CustomRecommendationName: pulumi.String("33e7cc6e-a139-4723-a0e5-76993aee0771"),
			Description:              pulumi.String("organization passwords policy"),
			DisplayName:              pulumi.String("Password Policy"),
			Query:                    pulumi.String("RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')"),
			RemediationDescription:   pulumi.String("Change password policy to..."),
			Scope:                    pulumi.String("subscriptions/e5d1b86c-3051-44d5-8802-aa65d45a279b"),
			SecurityIssue:            pulumi.String(security.SecurityIssueVulnerability),
			Severity:                 pulumi.String(security.SeverityEnumMedium),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.security.CustomRecommendation;
import com.pulumi.azurenative.security.CustomRecommendationArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var customRecommendation = new CustomRecommendation("customRecommendation", CustomRecommendationArgs.builder()
            .cloudProviders("AWS")
            .customRecommendationName("33e7cc6e-a139-4723-a0e5-76993aee0771")
            .description("organization passwords policy")
            .displayName("Password Policy")
            .query("RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')")
            .remediationDescription("Change password policy to...")
            .scope("subscriptions/e5d1b86c-3051-44d5-8802-aa65d45a279b")
            .securityIssue("Vulnerability")
            .severity("Medium")
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const customRecommendation = new azure_native.security.CustomRecommendation("customRecommendation", {
    cloudProviders: [azure_native.security.RecommendationSupportedClouds.AWS],
    customRecommendationName: "33e7cc6e-a139-4723-a0e5-76993aee0771",
    description: "organization passwords policy",
    displayName: "Password Policy",
    query: "RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
    remediationDescription: "Change password policy to...",
    scope: "subscriptions/e5d1b86c-3051-44d5-8802-aa65d45a279b",
    securityIssue: azure_native.security.SecurityIssue.Vulnerability,
    severity: azure_native.security.SeverityEnum.Medium,
});

    import pulumi
import pulumi_azure_native as azure_native

custom_recommendation = azure_native.security.CustomRecommendation("customRecommendation",
    cloud_providers=[azure_native.security.RecommendationSupportedClouds.AWS],
    custom_recommendation_name="33e7cc6e-a139-4723-a0e5-76993aee0771",
    description="organization passwords policy",
    display_name="Password Policy",
    query="RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')",
    remediation_description="Change password policy to...",
    scope="subscriptions/e5d1b86c-3051-44d5-8802-aa65d45a279b",
    security_issue=azure_native.security.SecurityIssue.VULNERABILITY,
    severity=azure_native.security.SeverityEnum.MEDIUM)

    resources:
  customRecommendation:
    type: azure-native:security:CustomRecommendation
    properties:
      cloudProviders:
        - AWS
      customRecommendationName: 33e7cc6e-a139-4723-a0e5-76993aee0771
      description: organization passwords policy
      displayName: Password Policy
      query: RawEntityMetadata | where Environment == 'GCP' and Identifiers.Type == 'compute.firewalls' | extend IslogConfigEnabled = tobool(Record.logConfig.enable) | extend HealthStatus = iff(IslogConfigEnabled, 'HEALTHY', 'UNHEALTHY')
      remediationDescription: Change password policy to...
      scope: subscriptions/e5d1b86c-3051-44d5-8802-aa65d45a279b
      securityIssue: Vulnerability
      severity: Medium

    Create CustomRecommendation Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CustomRecommendation(name: string, args: CustomRecommendationArgs, opts?: CustomResourceOptions);
    @overload
def CustomRecommendation(resource_name: str,
                         args: CustomRecommendationArgs,
                         opts: Optional[ResourceOptions] = None)

@overload
def CustomRecommendation(resource_name: str,
                         opts: Optional[ResourceOptions] = None,
                         scope: Optional[str] = None,
                         cloud_providers: Optional[Sequence[Union[str, RecommendationSupportedClouds]]] = None,
                         custom_recommendation_name: Optional[str] = None,
                         description: Optional[str] = None,
                         display_name: Optional[str] = None,
                         query: Optional[str] = None,
                         remediation_description: Optional[str] = None,
                         security_issue: Optional[Union[str, SecurityIssue]] = None,
                         severity: Optional[Union[str, SeverityEnum]] = None)
    func NewCustomRecommendation(ctx *Context, name string, args CustomRecommendationArgs, opts ...ResourceOption) (*CustomRecommendation, error)
    public CustomRecommendation(string name, CustomRecommendationArgs args, CustomResourceOptions? opts = null)
    public CustomRecommendation(String name, CustomRecommendationArgs args)
public CustomRecommendation(String name, CustomRecommendationArgs args, CustomResourceOptions options)

    type: azure-native:security:CustomRecommendation
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args CustomRecommendationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CustomRecommendationArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CustomRecommendationArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CustomRecommendationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CustomRecommendationArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var customRecommendationResource = new AzureNative.Security.CustomRecommendation("customRecommendationResource", new()
{
    Scope = "string",
    CloudProviders = new[]
    {
        "string",
    },
    CustomRecommendationName = "string",
    Description = "string",
    DisplayName = "string",
    Query = "string",
    RemediationDescription = "string",
    SecurityIssue = "string",
    Severity = "string",
});

    example, err := security.NewCustomRecommendation(ctx, "customRecommendationResource", &security.CustomRecommendationArgs{
	Scope: pulumi.String("string"),
	CloudProviders: pulumi.StringArray{
		pulumi.String("string"),
	},
	CustomRecommendationName: pulumi.String("string"),
	Description:              pulumi.String("string"),
	DisplayName:              pulumi.String("string"),
	Query:                    pulumi.String("string"),
	RemediationDescription:   pulumi.String("string"),
	SecurityIssue:            pulumi.String("string"),
	Severity:                 pulumi.String("string"),
})

    var customRecommendationResource = new CustomRecommendation("customRecommendationResource", CustomRecommendationArgs.builder()
    .scope("string")
    .cloudProviders("string")
    .customRecommendationName("string")
    .description("string")
    .displayName("string")
    .query("string")
    .remediationDescription("string")
    .securityIssue("string")
    .severity("string")
    .build());

    custom_recommendation_resource = azure_native.security.CustomRecommendation("customRecommendationResource",
    scope="string",
    cloud_providers=["string"],
    custom_recommendation_name="string",
    description="string",
    display_name="string",
    query="string",
    remediation_description="string",
    security_issue="string",
    severity="string")

    const customRecommendationResource = new azure_native.security.CustomRecommendation("customRecommendationResource", {
    scope: "string",
    cloudProviders: ["string"],
    customRecommendationName: "string",
    description: "string",
    displayName: "string",
    query: "string",
    remediationDescription: "string",
    securityIssue: "string",
    severity: "string",
});

    type: azure-native:security:CustomRecommendation
properties:
    cloudProviders:
        - string
    customRecommendationName: string
    description: string
    displayName: string
    query: string
    remediationDescription: string
    scope: string
    securityIssue: string
    severity: string

    CustomRecommendation Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The CustomRecommendation resource accepts the following input properties:

    Scope string
    The scope of the custom recommendation. Valid scopes are: management group (format: 'providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: 'subscriptions/{subscriptionId}'), or security connector (format: 'subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName})'
    CloudProviders List<Union<string, Pulumi.AzureNative.Security.RecommendationSupportedClouds>>
    List of all standard supported clouds.
    CustomRecommendationName string
    Name of the Custom Recommendation.
    Description string
    The description to relate to the assessments generated by this Recommendation.
    DisplayName string
    The display name of the assessments generated by this Recommendation.
    Query string
    KQL query representing the Recommendation results required.
    RemediationDescription string
    The remediation description to relate to the assessments generated by this Recommendation.
    SecurityIssue string | Pulumi.AzureNative.Security.SecurityIssue
    The severity to relate to the assessments generated by this Recommendation.
    Severity string | Pulumi.AzureNative.Security.SeverityEnum
    The severity to relate to the assessments generated by this Recommendation.
    Scope string
    The scope of the custom recommendation. Valid scopes are: management group (format: 'providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: 'subscriptions/{subscriptionId}'), or security connector (format: 'subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName})'
    CloudProviders []string
    List of all standard supported clouds.
    CustomRecommendationName string
    Name of the Custom Recommendation.
    Description string
    The description to relate to the assessments generated by this Recommendation.
    DisplayName string
    The display name of the assessments generated by this Recommendation.
    Query string
    KQL query representing the Recommendation results required.
    RemediationDescription string
    The remediation description to relate to the assessments generated by this Recommendation.
    SecurityIssue string | SecurityIssue
    The severity to relate to the assessments generated by this Recommendation.
    Severity string | SeverityEnum
    The severity to relate to the assessments generated by this Recommendation.
    scope String
    The scope of the custom recommendation. Valid scopes are: management group (format: 'providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: 'subscriptions/{subscriptionId}'), or security connector (format: 'subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName})'
    cloudProviders List<Either<String,RecommendationSupportedClouds>>
    List of all standard supported clouds.
    customRecommendationName String
    Name of the Custom Recommendation.
    description String
    The description to relate to the assessments generated by this Recommendation.
    displayName String
    The display name of the assessments generated by this Recommendation.
    query String
    KQL query representing the Recommendation results required.
    remediationDescription String
    The remediation description to relate to the assessments generated by this Recommendation.
    securityIssue String | SecurityIssue
    The severity to relate to the assessments generated by this Recommendation.
    severity String | SeverityEnum
    The severity to relate to the assessments generated by this Recommendation.
    scope string
    The scope of the custom recommendation. Valid scopes are: management group (format: 'providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: 'subscriptions/{subscriptionId}'), or security connector (format: 'subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName})'
    cloudProviders (string | RecommendationSupportedClouds)[]
    List of all standard supported clouds.
    customRecommendationName string
    Name of the Custom Recommendation.
    description string
    The description to relate to the assessments generated by this Recommendation.
    displayName string
    The display name of the assessments generated by this Recommendation.
    query string
    KQL query representing the Recommendation results required.
    remediationDescription string
    The remediation description to relate to the assessments generated by this Recommendation.
    securityIssue string | SecurityIssue
    The severity to relate to the assessments generated by this Recommendation.
    severity string | SeverityEnum
    The severity to relate to the assessments generated by this Recommendation.
    scope str
    The scope of the custom recommendation. Valid scopes are: management group (format: 'providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: 'subscriptions/{subscriptionId}'), or security connector (format: 'subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName})'
    cloud_providers Sequence[Union[str, RecommendationSupportedClouds]]
    List of all standard supported clouds.
    custom_recommendation_name str
    Name of the Custom Recommendation.
    description str
    The description to relate to the assessments generated by this Recommendation.
    display_name str
    The display name of the assessments generated by this Recommendation.
    query str
    KQL query representing the Recommendation results required.
    remediation_description str
    The remediation description to relate to the assessments generated by this Recommendation.
    security_issue str | SecurityIssue
    The severity to relate to the assessments generated by this Recommendation.
    severity str | SeverityEnum
    The severity to relate to the assessments generated by this Recommendation.
    scope String
    The scope of the custom recommendation. Valid scopes are: management group (format: 'providers/Microsoft.Management/managementGroups/{managementGroup}'), subscription (format: 'subscriptions/{subscriptionId}'), or security connector (format: 'subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Security/securityConnectors/{securityConnectorName})'
    cloudProviders List<String | "Azure" | "AWS" | "GCP">
    List of all standard supported clouds.
    customRecommendationName String
    Name of the Custom Recommendation.
    description String
    The description to relate to the assessments generated by this Recommendation.
    displayName String
    The display name of the assessments generated by this Recommendation.
    query String
    KQL query representing the Recommendation results required.
    remediationDescription String
    The remediation description to relate to the assessments generated by this Recommendation.
    securityIssue String | "Vulnerability" | "ExcessivePermissions" | "AnonymousAccess" | "NetworkExposure" | "TrafficEncryption" | "BestPractices"
    The severity to relate to the assessments generated by this Recommendation.
    severity String | "High" | "Medium" | "Low"
    The severity to relate to the assessments generated by this Recommendation.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CustomRecommendation resource produces the following output properties:

    AssessmentKey string
    The assessment metadata key used when an assessment is generated for this Recommendation.
    AzureApiVersion string
    The Azure API version of the resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Resource name
    SystemData Pulumi.AzureNative.Security.Outputs.SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    Type string
    Resource type
    AssessmentKey string
    The assessment metadata key used when an assessment is generated for this Recommendation.
    AzureApiVersion string
    The Azure API version of the resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    Name string
    Resource name
    SystemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    Type string
    Resource type
    assessmentKey String
    The assessment metadata key used when an assessment is generated for this Recommendation.
    azureApiVersion String
    The Azure API version of the resource.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Resource name
    systemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type String
    Resource type
    assessmentKey string
    The assessment metadata key used when an assessment is generated for this Recommendation.
    azureApiVersion string
    The Azure API version of the resource.
    id string
    The provider-assigned unique ID for this managed resource.
    name string
    Resource name
    systemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type string
    Resource type
    assessment_key str
    The assessment metadata key used when an assessment is generated for this Recommendation.
    azure_api_version str
    The Azure API version of the resource.
    id str
    The provider-assigned unique ID for this managed resource.
    name str
    Resource name
    system_data SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type str
    Resource type
    assessmentKey String
    The assessment metadata key used when an assessment is generated for this Recommendation.
    azureApiVersion String
    The Azure API version of the resource.
    id String
    The provider-assigned unique ID for this managed resource.
    name String
    Resource name
    systemData Property Map
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type String
    Resource type

    Supporting Types

    RecommendationSupportedClouds, RecommendationSupportedCloudsArgs

    Azure
    Azure
    AWS
    AWS
    GCP
    GCP
    RecommendationSupportedCloudsAzure
    Azure
    RecommendationSupportedCloudsAWS
    AWS
    RecommendationSupportedCloudsGCP
    GCP
    Azure
    Azure
    AWS
    AWS
    GCP
    GCP
    Azure
    Azure
    AWS
    AWS
    GCP
    GCP
    AZURE
    Azure
    AWS
    AWS
    GCP
    GCP
    "Azure"
    Azure
    "AWS"
    AWS
    "GCP"
    GCP

    SecurityIssue, SecurityIssueArgs

    Vulnerability
    Vulnerability
    ExcessivePermissions
    ExcessivePermissions
    AnonymousAccess
    AnonymousAccess
    NetworkExposure
    NetworkExposure
    TrafficEncryption
    TrafficEncryption
    BestPractices
    BestPractices
    SecurityIssueVulnerability
    Vulnerability
    SecurityIssueExcessivePermissions
    ExcessivePermissions
    SecurityIssueAnonymousAccess
    AnonymousAccess
    SecurityIssueNetworkExposure
    NetworkExposure
    SecurityIssueTrafficEncryption
    TrafficEncryption
    SecurityIssueBestPractices
    BestPractices
    Vulnerability
    Vulnerability
    ExcessivePermissions
    ExcessivePermissions
    AnonymousAccess
    AnonymousAccess
    NetworkExposure
    NetworkExposure
    TrafficEncryption
    TrafficEncryption
    BestPractices
    BestPractices
    Vulnerability
    Vulnerability
    ExcessivePermissions
    ExcessivePermissions
    AnonymousAccess
    AnonymousAccess
    NetworkExposure
    NetworkExposure
    TrafficEncryption
    TrafficEncryption
    BestPractices
    BestPractices
    VULNERABILITY
    Vulnerability
    EXCESSIVE_PERMISSIONS
    ExcessivePermissions
    ANONYMOUS_ACCESS
    AnonymousAccess
    NETWORK_EXPOSURE
    NetworkExposure
    TRAFFIC_ENCRYPTION
    TrafficEncryption
    BEST_PRACTICES
    BestPractices
    "Vulnerability"
    Vulnerability
    "ExcessivePermissions"
    ExcessivePermissions
    "AnonymousAccess"
    AnonymousAccess
    "NetworkExposure"
    NetworkExposure
    "TrafficEncryption"
    TrafficEncryption
    "BestPractices"
    BestPractices

    SeverityEnum, SeverityEnumArgs

    High
    High
    Medium
    Medium
    Low
    Low
    SeverityEnumHigh
    High
    SeverityEnumMedium
    Medium
    SeverityEnumLow
    Low
    High
    High
    Medium
    Medium
    Low
    Low
    High
    High
    Medium
    Medium
    Low
    Low
    HIGH
    High
    MEDIUM
    Medium
    LOW
    Low
    "High"
    High
    "Medium"
    Medium
    "Low"
    Low

    SystemDataResponse, SystemDataResponseArgs

    Metadata pertaining to creation and last modification of the resource.
    CreatedAt string
    The timestamp of resource creation (UTC).
    CreatedBy string
    The identity that created the resource.
    CreatedByType string
    The type of identity that created the resource.
    LastModifiedAt string
    The timestamp of resource last modification (UTC)
    LastModifiedBy string
    The identity that last modified the resource.
    LastModifiedByType string
    The type of identity that last modified the resource.
    CreatedAt string
    The timestamp of resource creation (UTC).
    CreatedBy string
    The identity that created the resource.
    CreatedByType string
    The type of identity that created the resource.
    LastModifiedAt string
    The timestamp of resource last modification (UTC)
    LastModifiedBy string
    The identity that last modified the resource.
    LastModifiedByType string
    The type of identity that last modified the resource.
    createdAt String
    The timestamp of resource creation (UTC).
    createdBy String
    The identity that created the resource.
    createdByType String
    The type of identity that created the resource.
    lastModifiedAt String
    The timestamp of resource last modification (UTC)
    lastModifiedBy String
    The identity that last modified the resource.
    lastModifiedByType String
    The type of identity that last modified the resource.
    createdAt string
    The timestamp of resource creation (UTC).
    createdBy string
    The identity that created the resource.
    createdByType string
    The type of identity that created the resource.
    lastModifiedAt string
    The timestamp of resource last modification (UTC)
    lastModifiedBy string
    The identity that last modified the resource.
    lastModifiedByType string
    The type of identity that last modified the resource.
    created_at str
    The timestamp of resource creation (UTC).
    created_by str
    The identity that created the resource.
    created_by_type str
    The type of identity that created the resource.
    last_modified_at str
    The timestamp of resource last modification (UTC)
    last_modified_by str
    The identity that last modified the resource.
    last_modified_by_type str
    The type of identity that last modified the resource.
    createdAt String
    The timestamp of resource creation (UTC).
    createdBy String
    The identity that created the resource.
    createdByType String
    The type of identity that created the resource.
    lastModifiedAt String
    The timestamp of resource last modification (UTC)
    lastModifiedBy String
    The identity that last modified the resource.
    lastModifiedByType String
    The type of identity that last modified the resource.

    Import

    An existing resource can be imported using its type token, name, and identifier, e.g.

    $ pulumi import azure-native:security:CustomRecommendation 33e7cc6e-a139-4723-a0e5-76993aee0771 /{scope}/providers/Microsoft.Security/customRecommendations/{customRecommendationName}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Azure Native pulumi/pulumi-azure-native
    License
    Apache-2.0
    azure-native logo
    This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
    Azure Native v3.13.0 published on Wednesday, Jan 28, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-azure-native
      Meet Neo: Your AI Platform Teammate