Control: Secure Boot should be enabled on supported Windows virtual machines

Description

Enable Secure Boot on supported Windows virtual machines to mitigate against malicious and unauthorized changes to the boot chain. Once enabled, only trusted bootloaders, kernel and kernel drivers will be allowed to run. This assessment applies to Trusted Launch and Confidential Windows virtual machines.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.compute_windows_vm_secure_boot_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.compute_windows_vm_secure_boot_enabled --share

SQL

This control uses a named query:

select
  a.id as resource,
  case
    when image_offer not like '%Windows%' or os_type not like 'Windows%' then 'skip'
    when security_profile ->> 'securityType' in ('TrustedLaunch','ConfidentialVM') and security_profile ->> 'uefiSettings' is not null and security_profile -> 'uefiSettings' ->> 'secureBootEnabled' = 'true' then 'ok'
    else 'alarm'
  end as status,
  case
    when image_offer not like '%Windows%' or os_type not like 'Windows%' then a.title || ' is not a windows VM.'
    when security_profile ->> 'securityType' in ('TrustedLaunch','ConfidentialVM') and security_profile ->> 'uefiSettings' is not null and security_profile -> 'uefiSettings' ->> 'secureBootEnabled' = 'true' then a.title || ' secure boot enabled.'
    else a.title || ' secure boot disabled.'
  end as reason
  
  , a.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_compute_virtual_machine as a,
  azure_subscription as sub
where
  sub.subscription_id = a.subscription_id

Control: Secure Boot should be enabled on supported Windows virtual machines

Description

Usage

SQL

Tags