Feature Request: Default to cost-conscious settings or warn users about the cost of the current default settings.

[c4milo]

We discovered the hard way how expensive the default management settings are. A warning about it or defaulting to more cost-conscious settings would be highly desired. Here are some of the things we did in case it helps others:

1. Disabled Sentinel
2. Put a daily cap on the Log Analytics ingestion (although we ran into management/log-analytics: Allow users to set a daily GB cap #1143)
3. Disabled most Azure Diagnostics and Security features

We plan to re-enable those features once we understand better the cost implications and how to keep them under control.

[matt-FFFFFF]

I'm sorry you had an unexpected bill. Our strategy with these modules is to set customers up for security and availability by default so we will be moving in the opposite direction.

One thing we could do is publish an example with a test/dev configuration that didn't have all the bells and whistles.

[c4milo]

I'm sorry you had an unexpected bill. Our strategy with these modules is to set customers up for security and availability by default so we will be moving in the opposite direction.

You can still set everything for security and availability but give people an explicit warning and choice to decide how much they want to spend on each service. We just spent USD$15k on the management subscription on data we were not analyzing yet, so we got $0 value from it. Other than that, we like and appreciate all the work that has gone into this Terraform module. It is great 🙏🏻

[chrishawl]

I'm sorry you had an unexpected bill. Our strategy with these modules is to set customers up for security and availability by default so we will be moving in the opposite direction.

One thing we could do is publish an example with a test/dev configuration that didn't have all the bells and whistles.

Hello. A dev/test example would be great. I'm currently looking at how we would deliver this iteratively, so as a first pass it would be great to have an example that say just setup the management groups and some archetypes, with just a single baseline policy set definition like the Microsoft security benchmark.

It'd be good to have a view on how you say moved from just management group setup into basic governance, followed by defender enablement and then log analytics onboarding.