> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Approved Azure Machine Image In Use ### More Info: Ensure that all the Azure virtual machine (VM) instances necessary for your application stack are launched from an approved base Azure machine image, known as golden machine image, in order to enforce application security best practices, consistency, and save time when scaling your application. ### Risk Level Medium ### Address Security ### Compliance Standards * Cloudanix Best Practice ### Triage and Remediation ### Remediation The issue of "Approved Azure Machine Image In Use" occurs when an Azure virtual machine is using an image that is not approved by the organization's policies. To remediate this issue, follow the steps below: 1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Go to the virtual machine that is using the unapproved image. 3. Stop the virtual machine. 4. Go to the "Disks" section of the virtual machine. 5. Select the OS disk of the virtual machine. 6. Click on the "Create snapshot" button to create a snapshot of the OS disk. 7. Go to the "Images" section of the Azure portal. 8. Click on the "Add" button to create a new image. 9. Fill in the necessary details for the new image, including the name, description, and the snapshot that was created in step 6. 10. Click on the "Create" button to create the new image. 11. Once the image is created, go back to the virtual machine that was using the unapproved image. 12. Go to the "Configuration" section of the virtual machine. 13. Change the "Image" setting to the new image that was created in step 10. 14. Start the virtual machine. The virtual machine should now be using the approved image, and the issue of "Approved Azure Machine Image In Use" should be remediated. # To remediate the "Approved Azure Machine Image In Use" misconfiguration in Azure using Azure CLI, you can follow these steps: 1. Identify the virtual machine(s) that are using the unapproved image. You can use the following Azure CLI command to list all the virtual machines in your subscription: ``` az vm list --query "[].{name:name, image:storageProfile.imageReference}" ``` This command will list all the virtual machines in your subscription along with their image references. 2. Check if any of the virtual machines are using the unapproved image. If you find any, note down their names. 3. Create a new virtual machine using an approved image. You can use the following Azure CLI command to create a new virtual machine: ``` az vm create --resource-group --name --image --admin-username --admin-password --authentication-type password --size --location ``` Replace the `` with the name of the resource group where you want to create the new virtual machine. Replace `` with the name you want to give to the new virtual machine. Replace `` with the name of the approved image that you want to use. Replace `` and `` with the username and password that you want to use to access the new virtual machine. Replace `` with the size of the virtual machine that you want to create. Replace `` with the location where you want to create the new virtual machine. 4. Once the new virtual machine is created, you can migrate the data and applications from the old virtual machine to the new one. 5. Once you have migrated all the data and applications, you can stop and delete the old virtual machine. You can use the following Azure CLI commands to stop and delete the old virtual machine: ``` az vm stop --resource-group --name ``` ``` az vm delete --resource-group --name --yes ``` Replace `` with the name of the resource group where the old virtual machine is located. Replace `` with the name of the old virtual machine that you want to delete. 6. Verify that the new virtual machine is working as expected. To remediate the misconfiguration "Approved Azure Machine Image In Use" in Azure using Python, you can follow the below steps: 1. First, you need to identify the virtual machines that are using the unapproved images. You can use the Azure Python SDK to get a list of all virtual machines in your subscription. ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient credential = DefaultAzureCredential() compute_client = ComputeManagementClient(credential, subscription_id) # Get a list of all virtual machines in the subscription vms = compute_client.virtual_machines.list_all() ``` 2. Next, you need to check the image used by each virtual machine. You can use the `osProfile` property of the virtual machine to get the image reference. ```python theme={null} for vm in vms: image_reference = vm.storage_profile.image_reference if image_reference.publisher == 'MicrosoftWindowsServer' and image_reference.offer == 'WindowsServer' and image_reference.sku == '2016-Datacenter': print(f"VM {vm.name} is using an unapproved image.") ``` In this example, we are checking if the virtual machine is using the Windows Server 2016 Datacenter image from Microsoft. You can replace this with the approved image reference for your organization. 3. Finally, you need to update the virtual machine to use the approved image. You can use the `begin_update` method of the virtual machine to update the image reference. ```python theme={null} for vm in vms: image_reference = vm.storage_profile.image_reference if image_reference.publisher == 'MicrosoftWindowsServer' and image_reference.offer == 'WindowsServer' and image_reference.sku == '2016-Datacenter': print(f"Updating VM {vm.name}...") vm.storage_profile.image_reference = { 'publisher': 'Canonical', 'offer': 'UbuntuServer', 'sku': '18.04-LTS', 'version': 'latest' } compute_client.virtual_machines.begin_update(resource_group_name, vm.name, vm) ``` In this example, we are updating the virtual machine to use the latest version of the Ubuntu Server 18.04 LTS image from Canonical. You can replace this with the approved image reference for your organization. Note: You need to have appropriate permissions to update the virtual machine. ```hcl theme={null} # Use your approved (golden) Azure image for this VM # Substitute: # - APPROVED_IMAGE_ID with the full resource ID of the approved managed image # or Shared Image Gallery image version (e.g. /subscriptions/.../resourceGroups/.../providers/Microsoft.Compute/galleries/.../images/.../versions/1.0.0) # - RESOURCE_GROUP_NAME, LOCATION, SUBNET_ID, etc. with real values resource "azurerm_linux_virtual_machine" "app_vm" { name = "APP_VM_NAME" resource_group_name = azurerm_resource_group.app_rg.name location = azurerm_resource_group.app_rg.location size = "Standard_DS1_v2" admin_username = "ADMIN_USERNAME" # KEY POINT: force use of the approved/base image source_image_id = "APPROVED_IMAGE_ID" network_interface_ids = [ azurerm_network_interface.app_nic.id, ] os_disk { caching = "ReadWrite" storage_account_type = "Standard_LRS" name = "APP_VM_OSDISK" } admin_ssh_key { username = "ADMIN_USERNAME" public_key = file("PATH_TO_PUBLIC_KEY") } } resource "azurerm_resource_group" "app_rg" { name = "RESOURCE_GROUP_NAME" location = "LOCATION" } resource "azurerm_network_interface" "app_nic" { name = "APP_NIC_NAME" location = azurerm_resource_group.app_rg.location resource_group_name = azurerm_resource_group.app_rg.name ip_configuration { name = "internal" subnet_id = "SUBNET_ID" private_ip_address_allocation = "Dynamic" } } ``` Changing a VM to use a different base image (`source_image_id` or `source_image_reference`) forces replacement; Terraform will destroy and recreate the VM and OS disk (data on the old OS disk will be lost unless separately preserved and reattached). To verify, `terraform plan` should show the VM resource either being created with `source_image_id = "APPROVED_IMAGE_ID"` or, for an existing VM, a `-/+` (destroy and recreate) on the `azurerm_linux_virtual_machine` (or `azurerm_windows_virtual_machine`) with the image change highlighted.