Azure Compute Audit - Security Checks
Checks Performed
- Approved Azure Machine Image In Use
- Azure Disk Encryption For Boot Disk Volumes
- Azure Disk Encryption For Non-Boot Disk
- Check For Desired VM SKU Size
- Check for Zone-Redundant Virtual Machine Scale Sets
- Disks Lacking Encryption
- Enable Accelerated Networking For Virtual Machines
- Enable and Configure Health Monitoring
- Enable Automatic Instance Repairs
- Enable Automatic OS Upgrades
- Enable Autoscale Notifications
- Enable Instance Termination Notifications For Virtual Machine Scale Sets
- Enable Just-In-Time Access for Virtual Machines
- Enable Performance Diagnostics for Azure Virtual Machines
- Enable System-Assigned Managed Identities
- Enable Virtual Machine Access using Active Directory Authentication
- Enable Virtual Machine Boot Diagnostics
- Install Endpoint Protection
- OS Disks Lacking Encryption
- Remove Unattached Virtual Machine Disk Volume
- Remove Unattached Virtual Machine Disk Volumes
- Server Side Encryption for Boot Disk using CMK
- Server Side Encryption for Non-Boot Disk using CMK
- Server Side Encryption for Unattached Disk using CMK
- Use BYOK for Disk Volumes Encryption
- Use Customer Managed Keys for Virtual Hard Disk Encryption
- Use Managed Disk Volumes for Virtual Machines
- Virtual Machine Extensions Installed
- Virtual Machines Should Have Backups
- Virtual Machines Should Have Sufficient Daily Backup Retention Period
- Virtual Machines Should Have Sufficient Instant Restore Retention Period
- Virtual Machines Should Only Allow SSH Based Authentication
- Virtual Machines Should Use Standard SSD
- VM Scale Sets Should Be Integrated With Load Balancers