7.4 Ensure that Only Approved Extensions Are Installed
Information
For added security, only install organization-approved extensions on VMs.Rationale:
Azure virtual machine extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. These extensions run with administrative privileges and could potentially access anything on a virtual machine. The Azure Portal and community provide several such extensions. Each organization should carefully evaluate these extensions and ensure that only those that are approved for use are actually implemented.
Impact:
Functionality by unsupported extensions will be disabled.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
From Azure ConsoleGo to Virtual machines
For each virtual machine, go to Settings
Click on Extensions + applications
If there are unapproved extensions, uninstall them.
From Azure Command Line Interface 2.0
From the audit command identify the unapproved extensions, and use the below CLI command to remove an unapproved extension attached to VM.
az vm extension delete --resource-group <resourceGroupName> --vm-name <vmName> --name <extensionName>
Using PowerShell
For each VM and each unsecured extension from the Audit Procedure run the following command.
Remove-AzVMExtension -ResourceGroupName <ResourceGroupName> -Name <ExtensionName> -VMName <VirtualMachineName>
Default Value:
By default, no extensions are added to the virtual machines.
See Also
Item Details
Audit Name: CIS Microsoft Azure Foundations v1.5.0 L1
Category: CONFIGURATION MANAGEMENT, MAINTENANCE
References: 800-53|CM-7(1), 800-53|CM-8, 800-53|MA-3, CSCv7|2.1
Plugin: microsoft_azure
Control ID: ff8064634692c2c108935ca97ab9db3d1e0a8b5bf3b7790ee6c159c8f142e853