> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit appservice check backup retention period remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration of "Sufficient Backup Retention Period" in Azure using the Azure console:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. In the left-hand menu, click on "Recovery Services vaults".
        3. Select the recovery services vault that you want to remediate.
        4. Click on the "Backup policy" option in the left-hand menu.
        5. In the "Backup policy" page, click on the "Edit" button.
        6. In the "Backup policy" editor, click on the "Retention" tab.
        7. In the "Retention" tab, set the retention period to the desired value.
        8. Click on the "Save" button to save the changes.

        By following these steps, you will remediate the misconfiguration of "Sufficient Backup Retention Period" in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of insufficient backup retention period in AZURE using AZURE CLI, follow the below steps:

        1. Open the Azure CLI in your terminal or command prompt.

        2. Run the following command to check the current retention period for backups:

           `az backup policy show --name <backup-policy-name> --resource-group <resource-group-name> --vault-name <vault-name>`

           Replace `<backup-policy-name>`, `<resource-group-name>` and `<vault-name>` with the actual names of your backup policy, resource group and vault respectively.

        3. Check the `retentionPolicy` object in the output to see the current retention period.

        4. Run the following command to update the retention period to the desired value:

           `az backup policy set --name <backup-policy-name> --resource-group <resource-group-name> --vault-name <vault-name> --retention-days <number-of-days>`

           Replace `<backup-policy-name>`, `<resource-group-name>`, `<vault-name>` and `<number-of-days>` with the actual names of your backup policy, resource group, vault and the desired number of retention days respectively.

        5. Verify that the retention period has been updated by running the command in step 2 again and checking the `retentionPolicy` object in the output.

        6. Repeat steps 2-5 for all backup policies in your Azure environment to ensure that all backups have sufficient retention periods.

        By following these steps, you can remediate the misconfiguration of insufficient backup retention period in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of insufficient backup retention period in Azure using Python, you can follow the below steps:

        1. Import the required libraries for Azure authentication and management:

        ```
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.recoveryservicesbackup import RecoveryServicesBackupClient
        from azure.mgmt.recoveryservicesbackup.models import ProtectionPolicyResource
        ```

        2. Authenticate with Azure using Service Principal credentials:

        ```
        credentials = ServicePrincipalCredentials(
            client_id='<client-id>',
            secret='<client-secret>',
            tenant='<tenant-id>'
        )
        ```

        3. Instantiate a `RecoveryServicesBackupClient` object using the credentials:

        ```
        client = RecoveryServicesBackupClient(credentials, '<subscription-id>')
        ```

        4. Get the list of backup protection policies:

        ```
        policies = client.protection_policies.list('<resource-group-name>', '<vault-name>')
        ```

        5. For each policy, check if the retention period is sufficient:

        ```
        for policy in policies:
            if policy.backup_management_type == 'AzureIaasVM':
                if policy.recovery_points_retention_period == 30:
                    policy.recovery_points_retention_period = 60
                    client.protection_policies.create_or_update('<resource-group-name>', '<vault-name>', policy.name, policy)
        ```

        6. If the retention period is not sufficient (in this case, 30 days), update the policy with a new retention period (in this case, 60 days):

        ```
        policy.recovery_points_retention_period = 60
        client.protection_policies.create_or_update('<resource-group-name>', '<vault-name>', policy.name, policy)
        ```

        7. Save the updated policy:

        ```
        client.protection_policies.create_or_update('<resource-group-name>', '<vault-name>', policy.name, policy)
        ```

        By following these steps, you can remediate the misconfiguration of insufficient backup retention period in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_app_service" "APP_SERVICE" {
          name                = "APP_SERVICE_NAME"
          resource_group_name = azurerm_resource_group.RG.name
          location            = azurerm_resource_group.RG.location
          app_service_plan_id = azurerm_app_service_plan.PLAN.id

          site_config {}
        }

        # Configure backups with a sufficient retention period (substitute values as needed)
        resource "azurerm_app_service_backup" "APP_SERVICE_BACKUP" {
          name                = "APP_SERVICE_BACKUP_NAME"
          resource_group_name = azurerm_resource_group.RG.name
          app_service_name    = azurerm_app_service.APP_SERVICE.name

          storage_account_url = "SAS_OR_BLOB_URL_FOR_BACKUPS" # replace with a valid SAS URL or blob URL

          schedule {
            frequency_interval     = 1              # every 1 day (example)
            frequency_unit         = "Day"          # "Day", "Hour"
            retention_period_in_days = 30           # set to the required minimum retention period
            keep_at_least_one_backup = true
          }
        }
        ```

        Substitute:

        * `APP_SERVICE_NAME` with your App Service name.
        * `APP_SERVICE_BACKUP_NAME` with a backup configuration name.
        * `SAS_OR_BLOB_URL_FOR_BACKUPS` with a valid SAS URL or blob URL to your backup Storage Account container.
        * `RG` and `PLAN` with your actual resource names/IDs.

        This change updates/creates the backup schedule and retention without forcing replacement of the App Service; only the `azurerm_app_service_backup` resource is added or updated.

        Verification: `terraform plan` should show an `azurerm_app_service_backup` resource being created or updated with `schedule.retention_period_in_days` set to your required value (e.g., `30`) and no destroy/recreate of the `azurerm_app_service`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>