> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit compute vms with extensions remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here are the step-by-step instructions to remediate the "Virtual Machine Extensions Installed" misconfiguration in Azure using the Azure console:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the virtual machine that has the misconfiguration.
        3. Click on the virtual machine to open its overview page.
        4. In the left-hand menu, click on "Extensions."
        5. In the list of extensions, locate the extension that needs to be removed and click on it.
        6. Click on the "Uninstall" button to remove the extension from the virtual machine.
        7. Confirm the removal by clicking "Yes" on the confirmation page.
        8. Wait for the extension to be uninstalled from the virtual machine.

        Once the extension has been successfully uninstalled, the misconfiguration will be remediated. It is important to note that some extensions may be required for the proper functioning of the virtual machine, so it is recommended to consult with the appropriate stakeholders before removing any extensions.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Virtual Machine Extensions Installed" in Azure using Azure CLI, follow the below steps:

        Step 1: Open the Azure CLI in your system.

        Step 2: Run the following command to list all the virtual machines in the Azure subscription:

        ```
        az vm list --query "[].{name:name, location:location, resourceGroup:resourceGroup}"
        ```

        Step 3: From the list of virtual machines, select the virtual machine for which you want to remove the extensions.

        Step 4: Run the following command to check the list of extensions installed on the virtual machine:

        ```
        az vm extension list --resource-group <resource-group-name> --vm-name <virtual-machine-name> --query "[].{name:name, publisher:publisher, type:type, autoUpgradeMinorVersion:autoUpgradeMinorVersion, settings:settings, protectedSettings:protectedSettings, provisioningState:provisioningState, instanceView:instanceView}"
        ```

        Step 5: From the list of extensions, select the extension that you want to remove.

        Step 6: Run the following command to remove the selected extension from the virtual machine:

        ```
        az vm extension delete --resource-group <resource-group-name> --vm-name <virtual-machine-name> --name <extension-name>
        ```

        Step 7: After running the above command, the extension will be removed from the virtual machine.

        Step 8: Repeat steps 4 to 7 for all the extensions that you want to remove from the virtual machine.

        Step 9: Once all the extensions are removed, the misconfiguration "Virtual Machine Extensions Installed" will be remediated in Azure.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the issue of virtual machine extensions installed in Azure using Python, you can follow the below steps:

        Step 1: Connect to Azure Subscription
        You need to connect to your Azure subscription using Python SDK. You can use the below code to authenticate and connect to the subscription.

        ```
        from azure.identity import AzureCliCredential
        from azure.mgmt.compute import ComputeManagementClient
        from azure.mgmt.resource import ResourceManagementClient

        credential = AzureCliCredential()

        subscription_id = 'your_subscription_id'

        compute_client = ComputeManagementClient(credential, subscription_id)
        resource_client = ResourceManagementClient(credential, subscription_id)
        ```

        Step 2: Get Virtual Machines
        You need to fetch the list of all virtual machines in your subscription. You can use the below code to get the list of virtual machines.

        ```
        vms = compute_client.virtual_machines.list_all()
        ```

        Step 3: Get Virtual Machine Extensions
        You need to get the list of all virtual machine extensions installed on each virtual machine. You can use the below code to get the list of extensions.

        ```
        for vm in vms:
            extensions = compute_client.virtual_machine_extensions.list(resource_group_name=vm.id.split('/')[4], virtual_machine_name=vm.name)
            for extension in extensions:
                print(extension.name)
        ```

        Step 4: Remove Virtual Machine Extensions
        You need to remove the virtual machine extensions from each virtual machine. You can use the below code to remove the extensions.

        ```
        for vm in vms:
            extensions = compute_client.virtual_machine_extensions.list(resource_group_name=vm.id.split('/')[4], virtual_machine_name=vm.name)
            for extension in extensions:
                compute_client.virtual_machine_extensions.delete(resource_group_name=vm.id.split('/')[4], virtual_machine_name=vm.name, extension_name=extension.name)
        ```

        Note: Please be cautious while deleting the extensions as it may impact the functionality of your virtual machines.

        By following the above steps, you can remediate the issue of virtual machine extensions installed in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Remove any azurerm_virtual_machine_extension resources attached to the VM.
        # Do NOT replace them with anything else – the finding is about having
        # extensions installed at all.

        # Example of what should be DELETED from your configuration:
        # (shown here only so you can identify it in your codebase)

        # resource "azurerm_virtual_machine_extension" "EXAMPLE_EXTENSION_NAME" {
        #   name                       = "EXTENSION_NAME"
        #   virtual_machine_id         = azurerm_windows_virtual_machine.MY_VM.id # or azurerm_linux_virtual_machine
        #   publisher                  = "PUBLISHER_NAME"
        #   type                       = "EXTENSION_TYPE"
        #   type_handler_version       = "VERSION"
        #   settings                   = jsonencode({ ... })
        #   protected_settings         = jsonencode({ ... })
        # }

        # Your VM resource remains without any extensions defined:

        resource "azurerm_windows_virtual_machine" "MY_VM" {
          name                = "VM_NAME"
          resource_group_name = azurerm_resource_group.MY_RG.name
          location            = azurerm_resource_group.MY_RG.location
          size                = "VM_SIZE"
          admin_username      = "ADMIN_USERNAME"
          admin_password      = "ADMIN_PASSWORD"

          network_interface_ids = [
            azurerm_network_interface.MY_NIC.id,
          ]

          os_disk {
            name                 = "OS_DISK_NAME"
            caching              = "ReadWrite"
            storage_account_type = "Standard_LRS"
          }

          source_image_reference {
            publisher = "MicrosoftWindowsServer"
            offer     = "WindowsServer"
            sku       = "2022-datacenter"
            version   = "latest"
          }
        }
        ```

        Removing all `azurerm_virtual_machine_extension` resources from your Terraform configuration will uninstall those extensions from the VM without recreating the VM itself.

        Verification: `terraform plan` should show only `-/destroy` actions for each `azurerm_virtual_machine_extension` associated with the VM, and no `create` or `update` actions adding new extensions.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>