Azure Virtual machine configured with public IP and serial console access misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_39
Category - Subcategory	Public Exposure - VPC VCN VNet
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c1f40894-1e56-4fdf-a4a8-0ee90a9f022e

Impact

This rule is checking to ensure that Azure Virtual Machines are not configured with both public IP and serial console access. It is bad because having both settings enabled can expose the virtual machine to unnecessary risks.

A public IP exposes the VM to the internet, which increases its vulnerability to attacks. On the other hand, enabling serial console access gives individuals the ability to control and configure the VM via the command line or terminal. If both of these features are enabled, an attacker who gains access to the VM can easily control the entire system, leading to potential data breaches, system failures, and other severe consequences.

Therefore, this rule aims to minimize risk by checking these configurations and ensuring they are not both enabled. It is advisable to limit those VM's exposure to the public internet and restricting console access to a few necessary and trusted individuals.

How to Fix

Resource: azurerm_network_interface

• Arguments: boot_diagnostics, ip_configuration.public_ip_address_id

To fix this issue, you need to remove the allocation of the public IP to the Azure VM and disable serial console access. [source,go]

resource "azurerm_network_interface" "example" { name = "example-nic" location = azurerm_resource_group.example.location resource_group_name = azurerm_resource_group.example.name

ip_configuration { name = "internal" subnet_id = azurerm_subnet.example.id private_ip_address_allocation = "Dynamic"

• public_ip_address_id = "" } }

resource "azurerm_linux_virtual_machine" "example" { admin_ssh_key { username = "adminuser" public_key = file("~/.ssh/id_rsa.pub") }

disable_password_authentication = true }