Azure Audit Compute Vms With Insufficient Instant Restore

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" in Azure:

Log in to the Azure portal (https://portal.azure.com/).
In the left-hand menu, click on "Virtual machines".
Select the virtual machine that you want to remediate.
In the virtual machine overview page, click on "Disks" under the "Settings" section.
Select the managed disk that you want to remediate.
Under the "Settings" section, click on "Backup".
In the "Backup policy" section, click on "Edit".
In the "Retention" section, set the "Instant restore snapshot retention range" to the desired value (e.g. 7 days).
Click on "Save" to save the changes.

By following these steps, you have successfully remediated the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" in Azure.

Using CLI

To remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" for Azure using Azure CLI, you can follow the below steps:

Open Azure CLI and login to your Azure account using the command az login.
Once you are logged in, check the current retention period of the virtual machine using the command az backup protection show --backup-management-type AzureIaasVM --query "items[].{VMName:name,RetentionPeriod:properties.instantRP.retentionPeriodInDays}".
If the retention period is less than the required duration, update the retention period using the command az backup protection update-for-vm --resource-group <resource-group-name> --vault-name <vault-name> --vm-name <vm-name> --policy-name <policy-name> --retention-in-days <retention-period>.

Note: Replace the placeholders <resource-group-name>, <vault-name>, <vm-name>, <policy-name> and <retention-period> with the actual values.
Verify that the retention period has been updated by running the command az backup protection show --backup-management-type AzureIaasVM --query "items[].{VMName:name,RetentionPeriod:properties.instantRP.retentionPeriodInDays}".
Once the retention period has been updated, the remediation is complete.

By following the above steps, you can remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" for Azure using Azure CLI.

Using Python

To remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" in Azure using Python, you can use the Azure Python SDK to update the retention period of the virtual machine backups.

Here are the steps to remediate the misconfiguration:

Install the Azure Python SDK by running the following command:
```
pip install azure-mgmt-compute
```

Authenticate with Azure by providing your subscription ID, tenant ID, client ID, and client secret. You can do this by creating a Service Principal and granting it the required permissions.

from azure.common.credentials import ServicePrincipalCredentials

subscription_id = '<your-subscription-id>'
credentials = ServicePrincipalCredentials(
    client_id='<your-client-id>',
    secret='<your-client-secret>',
    tenant='<your-tenant-id>'
)

Use the ComputeManagementClient class from the Azure Python SDK to get a list of all the virtual machines in your subscription.

from azure.mgmt.compute import ComputeManagementClient

compute_client = ComputeManagementClient(credentials, subscription_id)
vm_list = compute_client.virtual_machines.list_all()

For each virtual machine in the list, use the BackupManagementClient class from the Azure Python SDK to get the current retention policy for the virtual machine backups.

from azure.mgmt.recoveryservicesbackup import BackupManagementClient

backup_client = BackupManagementClient(credentials, subscription_id)
for vm in vm_list:
    backup_policy = backup_client.backup_policies.get(
        '<your-resource-group>',
        '<your-backup-policy-name>'
    )
    retention_period = backup_policy.instant_rp.retention_period_in_days

If the retention period is less than the recommended value, update the retention policy using the BackupManagementClient class.

if retention_period < <recommended-retention-period>:
    backup_policy.instant_rp.retention_period_in_days = <recommended-retention-period>
    backup_client.backup_policies.create_or_update(
        '<your-resource-group>',
        '<your-backup-policy-name>',
        backup_policy
    )

Run the script periodically to ensure that the retention policies of all virtual machines are up-to-date.

Note: Replace the placeholders <your-subscription-id>, <your-client-id>, <your-client-secret>, <your-tenant-id>, <your-resource-group>, <your-backup-policy-name>, and <recommended-retention-period> with your own values.

Using Terraform

# Backup policy used by the VM; ensure instant restore retention is at least 5 days
resource "azurerm_backup_policy_vm" "VM_BACKUP_POLICY" {
  name                = "VM_BACKUP_POLICY_NAME"                    # replace with your policy name
  resource_group_name = "RECOVERY_VAULT_RESOURCE_GROUP_NAME"       # replace with the RG of the recovery vault
  recovery_vault_name = "RECOVERY_SERVICES_VAULT_NAME"             # replace with your vault name

  backup {
    frequency = "Daily"
    time      = "23:00"
  }

  retention_daily {
    count = 30
  }

  # This is the setting that fixes the finding (must be between 1 and 5; rule requires 5)
  instant_restore_retention_days = 5
}

# VM protected by the above backup policy (for context on how it attaches)
resource "azurerm_backup_protected_vm" "VM_BACKUP_PROTECTION" {
  resource_group_name = "RECOVERY_VAULT_RESOURCE_GROUP_NAME"       # same as vault RG
  recovery_vault_name = "RECOVERY_SERVICES_VAULT_NAME"
  source_vm_id        = azurerm_windows_virtual_machine.VM_NAME.id # or azurerm_linux_virtual_machine
  backup_policy_id    = azurerm_backup_policy_vm.VM_BACKUP_POLICY.id
}

This change is an in-place update of the backup policy and does not force replacement of the VM or the policy resource.

Verification: terraform plan should show an update to azurerm_backup_policy_vm.VM_BACKUP_POLICY with instant_restore_retention_days changing from its current value to 5, and no replacements.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation