Remove Unattached Virtual Machine Disk Volume

More Info:

Identify any unattached (unused) Microsoft Azure virtual machine disk volumes available within your Azure cloud account and delete them in order to lower the cost of your monthly bill and reduce the risk of sensitive data leakage.

Risk Level

Medium

Address

Security

Compliance Standards

• HITRUST CSF

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the "Remove Unattached Virtual Machine Disk Volume" misconfiguration for Azure using the Azure console:

1. Log in to the Azure portal (https://portal.azure.com/).
2. Click on the "Virtual machines" option in the left-hand menu.
3. Select the virtual machine that has the unattached disk volume you want to remove.
4. Click on the "Disks" option in the left-hand menu.
5. Identify the unattached disk volume by looking for the "Unattached" status in the "Status" column.
6. Select the unattached disk volume by clicking on its name.
7. Click on the "Delete" button in the top menu bar.
8. In the confirmation window, click on the "Yes" button to confirm that you want to delete the unattached disk volume.

That's it! The unattached virtual machine disk volume has been successfully removed from your Azure account.

Using CLI

To remediate the "Remove Unattached Virtual Machine Disk Volume" misconfiguration for AZURE using AZURE CLI, you can follow these step-by-step instructions:

1. Open the AZURE CLI on your computer.

2. Run the following command to list all the virtual machines in your subscription:

   az vm list --query "[].{name:name,resourceGroup:resourceGroup}" --output table

   This will list all the virtual machines in your subscription along with their resource group.

3. Identify the virtual machine for which there are unattached disks.

4. Run the following command to list all the disks in your subscription:

   az disk list --query "[].{name:name,resourceGroup:resourceGroup}" --output table

   This will list all the disks in your subscription along with their resource group.

5. Identify the unattached disks that belong to the virtual machine identified in step 3.

6. Run the following command to delete the unattached disk:

   az disk delete --name <disk-name> --resource-group <resource-group-name>

   Replace <disk-name> with the name of the unattached disk and <resource-group-name> with the name of the resource group the disk belongs to.

7. Confirm the deletion by typing "y" when prompted.

8. Repeat steps 6 and 7 for all the unattached disks that belong to the identified virtual machine.

9. Verify that all the unattached disks have been deleted by running the command in step 4 again.

   This completes the remediation of the "Remove Unattached Virtual Machine Disk Volume" misconfiguration for AZURE using AZURE CLI.

Using Python

To remediate the "Remove Unattached Virtual Machine Disk Volume" misconfiguration in Azure using Python, you can follow the below steps:

1. Import the necessary libraries:

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

2. Authenticate with Azure using the DefaultAzureCredential class:

credential = DefaultAzureCredential()
subscription_id = "your_subscription_id"
compute_client = ComputeManagementClient(credential, subscription_id)

3. Get a list of all virtual machines in the subscription:

vm_list = compute_client.virtual_machines.list_all()

4. For each virtual machine, get a list of all the disk volumes attached to it:

for vm in vm_list:
    vm_id = vm.id
    vm_name = vm.name
    vm_rg_name = vm_id.split('/')[4]
    vm_disk_list = compute_client.disks.list_by_vm(vm_rg_name, vm_name)

5. For each disk volume, check if it is attached to any virtual machine. If it is not attached, delete the disk volume:

for disk in vm_disk_list:
    disk_id = disk.id
    disk_name = disk.name
    disk_rg_name = disk_id.split('/')[4]
    disk_attach = compute_client.disks.list_vm_attachments(disk_rg_name, disk_name)
    if not disk_attach:
        compute_client.disks.delete(disk_rg_name, disk_name)

6. Run the Python script and verify that all unattached disk volumes have been removed.

Note: Make sure to test the script in a non-production environment before running it in a production environment.

Using Terraform

# Delete the unattached managed disk by removing or updating this resource.
# Replace PLACEHOLDER_* with your actual values if you need to keep other disks.

resource "azurerm_managed_disk" "UNATTACHED_DISK" {
  name                = "PLACEHOLDER_DISK_NAME"
  resource_group_name = "PLACEHOLDER_RESOURCE_GROUP"
  location            = "PLACEHOLDER_LOCATION"

  storage_account_type = "Standard_LRS"
  create_option        = "Empty"
  disk_size_gb         = 128
}

# --- REMEDIATION IN TERRAFORM ---

# To remove an unattached disk:
# 1. Delete the azurerm_managed_disk "UNATTACHED_DISK" block entirely from your code
#    (or set `count = 0` / adjust for_each so this specific disk is no longer created).
# 2. Run `terraform apply` to destroy the disk in Azure.
#
# This change destroys the disk permanently; data on it is irrecoverable.

This fix forces a destroy of the managed disk (an irreversible data-loss operation, though it does not cause VM downtime if the disk is truly unattached).

For verification, terraform plan should show a single - (destroy) action for the specific azurerm_managed_disk resource representing the unattached volume.