Control: 7.4 Ensure that only approved extensions are installed
Description
Install only organization-approved extensions on VMs. Azure virtual machine extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. These extensions run with administrative privileges and could potentially access anything on a virtual machine. The Azure Portal and community provide several such extensions. Each organization should carefully evaluate these extensions and ensure that only those that are approved for use are actually implemented.
By default, no extensions are added to the virtual machines.
Remediation
From Console
Perform the following action to check approved extensions are installed on a VM:
- Go to
Virtual machines. - For each virtual machine, go to
Settings. - Click on
Extensions. - Ensure that the listed extensions are approved for use.
Perform the following action to un-install unapproved extensions on a VM:
- Go to
Virtual machines. - For each virtual machine, go to
Settings. - Click on
Extensions. - If there are any unapproved extensions, uninstall them.
From Command Line
From the check, identify the unapproved extensions, and use the below CLI command to remove an unapproved extension attached to VM
az vm extension delete --resource-group <resourceGroupName> --vm-name <vmName> --name <extensionName>
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v130_7_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v130_7_4 --shareSQL
This control uses a named query:
manual_control