Skip to main content

Virtual Machines Should Use Standard SSD

More Info:​

Ensure that your Microsoft Azure virtual machines (VMs) are using Standard SSD disk volumes instead of Premium SSD volumes for cost-effective storage that fits a broad range of workloads from web servers to enterprise applications that need consistent performance at lower IOPS levels. Unless you are running mission-critical applications or performance sensitive workloads that need more than 6000 IOPS or 750 MiB/s of throughput per VM disk volume, its recommends converting your Premium SSD volumes to Standard SSD in order to lower the cost of your Azure monthly bill.

Risk Level​

Low

Address​

Cost Optimization

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To remediate the "Virtual Machines Should Use Standard SSD" misconfiguration in Azure using the Azure console, follow these steps:

  1. Navigate to the Azure portal and log in with your credentials.
  2. Click on the "Virtual machines" option in the left-hand menu.
  3. Select the virtual machine that you want to remediate.
  4. Click on "Disks" in the left-hand menu.
  5. Select the disk that you want to update to use Standard SSD.
  6. Click on "Change SKU" at the top of the page.
  7. Select "Standard SSD" from the dropdown menu.
  8. Click "Save" to apply the changes.

Once these steps have been completed, the virtual machine will be using Standard SSD and the misconfiguration will be remediated.

Using CLI

To remediate the misconfiguration "Virtual Machines Should Use Standard SSD" for Azure using Azure CLI, please follow the below steps:

Step 1: Open the Azure CLI in your terminal.

Step 2: Run the following command to list all the virtual machines in your subscription:

az vm list --query "[].{Name:name, OS:storageProfile.osDisk.name, DiskType:storageProfile.osDisk.managedDisk.storageAccountType}" --output table

This command will list all the virtual machines along with their OS disk name and disk type (whether it is using Standard HDD, Standard SSD or Premium SSD).

Step 3: Identify the virtual machines that are using Standard HDD or Premium SSD disks. These virtual machines need to be remediated to use Standard SSD disks.

Step 4: Run the following command to update the disk type of the identified virtual machine to Standard SSD:

az vm update --resource-group <resource-group-name> --name <vm-name> --set storageProfile.osDisk.managedDisk.storageAccountType=Standard_LRS

Make sure to replace <resource-group-name> with the name of the resource group where the virtual machine is located and <vm-name> with the name of the virtual machine that needs to be remediated.

Step 5: Verify that the disk type of the virtual machine has been updated to Standard SSD by running the following command:

az vm show --resource-group <resource-group-name> --name <vm-name> --query "storageProfile.osDisk.managedDisk.storageAccountType"

This command should return the value "Standard_LRS", indicating that the virtual machine is now using Standard SSD disks.

Step 6: Repeat steps 3-5 for all the virtual machines that are using Standard HDD or Premium SSD disks.

By following these steps, you can remediate the misconfiguration "Virtual Machines Should Use Standard SSD" for Azure using Azure CLI.

Using Python

To remediate the misconfiguration "Virtual Machines Should Use Standard SSD" for AZURE using Python, you can follow the below steps:

  1. First, you need to identify the virtual machines that are not using standard SSD disks. You can achieve this by using the Azure Python SDK.

  2. Install the Azure Python SDK by running the following command in your terminal:

pip install azure-mgmt-compute

  1. Once you have installed the SDK, you need to authenticate to your Azure account. You can do this by creating a Service Principal and providing the necessary credentials.

  2. After authentication, you need to create a compute client using the Azure Python SDK. You can do this by running the following code:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.compute import ComputeManagementClient

# Provide the necessary credentials
subscription_id = '<your-subscription-id>'
credentials = ServicePrincipalCredentials(
    client_id='<your-client-id>',
    secret='<your-client-secret>',
    tenant='<your-tenant-id>'
)

# Create a compute client
compute_client = ComputeManagementClient(
    credentials=credentials,
    subscription_id=subscription_id
)
  1. Once you have created the compute client, you can use it to retrieve a list of virtual machines in your subscription. You can do this by running the following code:
# Retrieve a list of virtual machines
vm_list = compute_client.virtual_machines.list_all()

# Loop through the virtual machines and check if they are using standard SSD disks
for vm in vm_list:
    for disk in vm.storage_profile.data_disks:
        if disk.managed_disk.storage_account_type != 'StandardSSD_LRS':
            # If the virtual machine is not using standard SSD disks, remediate it
            disk.managed_disk.storage_account_type = 'StandardSSD_LRS'
            compute_client.virtual_machines.create_or_update(
                resource_group_name=vm.id.split('/')[4],
                vm_name=vm.name,
                parameters=vm
            )

  1. The above code loops through all the virtual machines in your subscription and checks if they are using standard SSD disks. If a virtual machine is not using standard SSD disks, it updates the disk to use standard SSD and saves the changes.

  2. After running the above code, you can verify that all your virtual machines are using standard SSD disks by checking the storage account type of the disks associated with each virtual machine.

Note: Make sure to test this code in a non-production environment before running it in production.

Using Terraform
resource "azurerm_windows_virtual_machine" "VM_NAME" {
  name                = "VM_NAME"                         # replace with your VM name
  resource_group_name = azurerm_resource_group.RG.name    # replace with your RG resource
  location            = azurerm_resource_group.RG.location
  size                = "STANDARD_D2S_V3"                 # replace with your VM size
  admin_username      = "ADMIN_USERNAME"                  # replace
  admin_password      = "ADMIN_PASSWORD"                  # replace
  network_interface_ids = [
    azurerm_network_interface.NIC.id,                     # replace with your NIC resource
  ]

  # This is the key change: move OS disk to Standard SSD
  os_disk {
    name                 = "VM_OS_DISK_NAME"              # replace
    caching              = "ReadWrite"
    storage_account_type = "StandardSSD_LRS"              # was Premium_LRS
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2019-Datacenter"
    version   = "latest"
  }
}

# Example of a separate data disk also converted to Standard SSD
resource "azurerm_managed_disk" "VM_DATA_DISK" {
  name                 = "VM_DATA_DISK_NAME"              # replace
  location             = azurerm_resource_group.RG.location
  resource_group_name  = azurerm_resource_group.RG.name
  storage_account_type = "StandardSSD_LRS"                # was Premium_LRS
  create_option        = "Empty"
  disk_size_gb         = 128                              # adjust as needed
}

resource "azurerm_virtual_machine_data_disk_attachment" "VM_DATA_DISK_ATTACH" {
  managed_disk_id    = azurerm_managed_disk.VM_DATA_DISK.id
  virtual_machine_id = azurerm_windows_virtual_machine.VM_NAME.id
  lun                = 0
  caching            = "ReadOnly"
}

Changing os_disk.storage_account_type and any existing azurerm_managed_disk.storage_account_type from Premium_LRS to StandardSSD_LRS forces replacement of those disks and, for the OS disk, recreation of the VM, which causes downtime; this is irreversible from Terraform’s perspective even though Azure supports online conversions via CLI/portal.

For verification, terraform plan should show the storage_account_type arguments for the OS and data disks changing from Premium_LRS to StandardSSD_LRS, with the associated disk (and VM for the OS disk) marked for replacement.

Additional Reading:​