|   Trend Micro Cloud One™
Open menu

Use Managed Disk Volumes for Virtual Machines

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Risk level: Medium (should be achieved)
Rule ID: VirtualMachines-009

Ensure that your Microsoft Azure virtual machines (VMs) are configured to use managed disk volumes for reliable, efficient and simplified disk management. A managed disk is an abstraction of current Standard/Premium storage disk in Azure Storage. Managed disks provide granular access control with RBAC and better reliability for the virtual machines deployed within an Azure Availability Set.

The main benefits of using managed disk volumes for VMs are:

High availability (HA) - the managed disk volumes have a 99.99% SLA in all Availability Zones (AZs).

High fault tolerance - the managed disks provisioned within an Azure Availability Set are spread across multiple storage fault domains to protect against single points of failure.

High scalability - can be deployed up to 50,000 managed disk volumes per Azure subscription per region.

This rule resolution is part of the Cloud Conformity Security & Compliance tool for Azure

Reliability
Performance
efficiency

For best performance, scalability, reliability and access control, Cloud Conformity recommends using Azure managed disk volumes for most virtual machine (VM) configurations. Azure unmanaged disk volumes should be used only to support rare scenarios or to manage disk VHDs within your own storage account.

Audit

To determine if your Azure virtual machines are using managed disk volumes, perform the following actions:

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

03 Choose the Azure subscription that you want to access from the Subscription filter box.

04 From the Type filter box, select Virtual machine to list only the virtual machines (VMs) provisioned in your Azure account.

05 Click on the name of the virtual machine that you want to examine.

06 In the navigation panel, under Settings, select Disks to view the disk volumes attached to the selected VM.

07 On the Disks page, click on the name (link) of the volume that you want to examine.

08 On the selected disk volume page, check the name of the resource, listed on top of the page. If the resource name contains (unmanaged), the selected Azure virtual machine disk volume is not managed by Microsoft Azure.

09 Repeat step no. 7 and 8 for each disk volume attached to the selected virtual machine (VM).

10 Repeat steps no. 5 – 9 for every Azure virtual machine available in the selected subscription.

11 Repeat steps no. 3 – 10 for each subscription created in your Microsoft Azure cloud account.

Using Azure CLI

01 Run vm list command (Windows/macOS/Linux) using custom query filters to list the ID of each Azure virtual machine (VM) provisioned within the current subscription:

az vm list
    --query '[*].id'

02 The command output should return the requested virtual machine IDs:

[
"/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-webstore-vm",
"/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-project9-vm"
]

03 Run vm show command (Windows/macOS/Linux) using the ID of the virtual machine that you want to examine as identifier parameter to get the ID(s) of managed disk volume(s) attached to the selected VM:

az vm show
    --ids "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-webstore-vm"
    --query 'storageProfile.{"osDiskType":osDisk.managedDisk.id,"dataDiskType":dataDisks[*].managedDisk.id}'

04 The command output should return the ID of each managed disk volume attached:

{
  "osDiskType": null,
  "dataDiskType": []
}

If the vm show command output returns null or [] instead of the resource ID, as the value for the "osDiskType" and/or "dataDiskType" configuration attributes, the selected Microsoft Azure virtual machine is not using managed OS/data disk volume(s).

05 Repeat step no. 3 and 4 for each Azure virtual machine (VM) available in the current subscription.

06 Repeat steps no. 1 – 5 for each subscription created within your Microsoft Azure cloud account.

Remediation / Resolution

To convert any unmanaged disk volumes attached to your Azure virtual machines to managed disk volumes, perform the following actions:

Note: The source unmanaged VM disks are not deleted after the migration to managed disks. The managed disks are created by making a copy of the source disks. The configuration of the selected Microsoft Azure virtual machines is not changed after the migration is completed.

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to All resources blade at https://portal.azure.com/#blade/HubsExtension/BrowseAll to access all your Microsoft Azure resources.

03 Choose the Azure subscription that you want to access from the Subscription filter box.

04 From the Type filter box, select Virtual machine to list the virtual machines launched in your Azure cloud account.

05 Click on the name of the virtual machine (VM) that you want to examine.

06 In the navigation panel, under Settings, select Disks to view the disk volumes attached to the selected VM.

07 On the Disks page, click Migrate to managed disks button from the panel top menu to initiate the process.

08 On the Migrate to managed disks page, click Migrate to run the migration process. The selected Microsoft Azure virtual machine will be stopped and restarted after the migration is complete.

09 Repeat steps no. 5 – 8 for each Azure virtual machine that has unmanaged disk volumes attached, provisioned in the selected subscription.

10 Repeat steps no. 3 – 9 for each subscription available in your Microsoft Azure cloud account.

Using Azure Console

01 Run vm deallocate command (Windows/macOS/Linux) to deallocate (i.e. shutdown) the Azure virtual machine that has unmanaged disk volumes – see Audit section part II to identify the right VM (the command does not produce an output):

az vm deallocate
    --ids "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-webstore-vm"

02 Run vm convert command (Windows/macOS/Linux) using the ID of the virtual machine (VM) that you want to reconfigure as identifier parameter, to convert the unmanaged disk volumes attached to the selected VM into managed disk volumes (the command does not return an output):

az vm convert
    --ids "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-webstore-vm"

03 Run vm start command (Windows/macOS/Linux) to restart the reconfigured Microsoft Azure virtual machine (the command does not produce an output):

az vm start
    --ids "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-webstore-vm"

04 Repeat steps no. 1 – 3 for each virtual machine that has unmanaged disk volumes attached, available in the selected subscription.

05 Repeat steps no. 1 – 4 for each subscription created in your Microsoft Azure cloud account.

References

Publication date Jun 24, 2020

Unlock the Remediation Steps

Gain free unlimited access to our full Knowledge Base


Over 600 rules & best practices for and

Get started for FREE

A verification email will be sent to this address
We keep your information private. Learn more.

Thank you!

Please click the link in the confirmation email sent to

You are auditing:

Use Managed Disk Volumes for Virtual Machines

Risk level: Medium