Pipeline: 8.7 Ensure that Only Approved Extensions Are Installed

Description

For added security, only install organization-approved extensions on VMs.

Azure virtual machine extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. These extensions run with administrative privileges and could potentially access anything on a virtual machine. The Azure Portal and community provide several such extensions. Each organization should carefully evaluate these extensions and ensure that only those that are approved for use are actually implemented.

Remediation

From Azure Portal

Go to Virtual machines.
For each virtual machine, go to Settings.
Click on Extensions + applications.
If there are unapproved extensions, uninstall them.

From Azure CLI

From the audit command identify the unapproved extensions, and use the below CLI command to remove an unapproved extension attached to VM.

az vm extension delete --resource-group <resourceGroupName> --vm-name <vmName> --name <extensionName>

From PowerShell

For each VM and each insecure extension from the Audit Procedure run the following command.

Remove-AzVMExtension -ResourceGroupName <ResourceGroupName> -Name <ExtensionName> -VMName <VirtualMachineName>

Default Value

By default, no extensions are added to the virtual machines.

Run the pipeline

To run this pipeline from your terminal:

flowpipe pipeline run azure_cis.pipeline.cis_v300_8_7

Use this pipeline

To call this pipeline from your pipeline, use a step:

step "pipeline" "step_name" {
  pipeline = azure_cis.pipeline.cis_v300_8_7  
}

Params

Name	Type	Required	Description	Default
database	connection.steampipe	Yes	Database connection string.	`connection.steampipe.default`
notifier	notifier	Yes	The name of the notifier to use for sending notification messages.	`notifier.default`
notification_level	string	Yes	The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.	`info`
approvers	list(notifier)	Yes	List of notifiers to be used for obtaining action/approval decisions.	`notifier.default`

Outputs

This pipeline has no outputs.