How to enable express Vulnerability assessment on Azure SQL Server using AzAPI provider

There is an option to execute Vulnerability Assessment with an express configuration which doesn't require storage account.

I want to use AzAPI update resource to set this, but I don't see this option on the definition.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Sql/servers/vulnerabilityAssessments@2022-05-01-preview"
  name = "default"
  parent_id = "string"
  body = jsonencode({
    properties = {
      recurringScans = {
        emails = [
          "string"
        ]
        emailSubscriptionAdmins = bool
        isEnabled = bool
      }
      storageAccountAccessKey = "string"
      storageContainerPath = "string"
      storageContainerSasKey = "string"
    }
  })
}

Is it possible?

How to enable express Vulnerability assessment on Azure SQL Server using AzAPI provider:

After a workaround on your requirement, I found there that there is "no direct way to automate the express vulnerability assessment on SQL server utilizing bicep". You must use Azure PowerShell or CLI to make it operate beyond the Azure portal.

I tried an alternative way with the azapi_update_resource resource to enable vulnerability assessment, however it only works well when the storagecontainerpath attribute is added if you'd like to use a bicep.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
      version = "1.9.0"
    }
  }
}

provider "azurerm"{
features{}
}

provider "azapi"{}

data "azurerm_resource_group" "example"{
name = "xxxx"
}
data "azurerm_mssql_server" "example"{
name = "newser"
resource_group_name = data.azurerm_resource_group.example.name
}

data "azurerm_mssql_database" "example" {

name = "newdb"
server_id = data.azurerm_mssql_server.example.id

}

resource "azapi_update_resource" "example" {
  type = "Microsoft.Sql/servers/vulnerabilityAssessments@2022-05-01-preview"
  name = "expressjahc"
  parent_id = data.azurerm_mssql_server.example.id
  body = jsonencode({
    properties = {
      recurringScans = {
        isEnabled = true
      }
     storageContainerPath = "https://<storageaccount>.blob.core.windows.net/new"
    }
  })
}

Deployment succeeded: