Windows VM Without Automatic Updates misconfiguration detected in code

Windows VM Without Automatic Updates misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_177
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Automatic updates are crucial for maintaining the security and performance of systems. Regular updates address vulnerabilities that might be exploited, provide enhancements, and deliver crucial security patches. For Windows Virtual Machines (VMs) and Virtual Machine Scale Sets in Azure, enabling automatic updates ensures that these instances remain up-to-date with the latest patches from Microsoft.

This rule checks to ensure that Windows VMs and VM Scale Sets are configured to have automatic updates enabled.

How to Fix

Resources:

• azurerm_windows_virtual_machine

• azurerm_windows_virtual_machine_scale_set

Argument:

• enable_automatic_updates

Note: It's recommended to enable automatic updates on all Windows VM and VM Scale Set instances in Azure to ensure they receive the latest security patches and updates from Microsoft. [source,go]

resource "azurerm_windows_virtual_machine" "example" { name = "example-vm" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name

... other configurations ...

• enable_automatic_updates = true }

resource "azurerm_windows_virtual_machine_scale_set" "example" { name = "example-vmss" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name

... other configurations ...

• enable_automatic_updates = true }

---