Azure / Azure/PSRule.Rules.Azure

[RULE] Azure Fleets should use secure boot

Open
#3,729 2 comments 0 reactions 0 assignees View on GitHub
good first issue pillar: security rule: fleet
Dominant language
PowerShell
Stars
447
Forks
109
Avg merge
2d 19h
Merged PRs (30d)
23

Description

### Existing rule

_No response_

### Suggested rule

Fleets `Microsoft.AzureFleet/fleets` should use secure boot by setting the property `properties.computeProfile.baseVirtualMachineProfile.securityProfile.securityType` = `TrustedLaunch` and `properties.computeProfile.baseVirtualMachineProfile.securityProfile.uefiSettings.secureBootEnabled` = `true`.

At the root of Trusted Launch is Secure Boot for your VM. Secure Boot, which is implemented in platform firmware, protects against the installation of malware-based rootkits and boot kits. Secure Boot works to ensure that only signed operating systems and drivers can boot. It establishes a "root of trust" for the software stack on your VM.

With Secure Boot enabled, all OS boot components (boot loader, kernel, kernel drivers) require trusted publishers signing. Both Windows and select Linux distributions support Secure Boot. If Secure Boot fails to authenticate that the image is signed with a trusted publisher, the VM fails to boot.

### Pillar

Security

### Additional context

Setting the security type to `ConfidentialVM` is also acceptable.

- https://learn.microsoft.com/azure/virtual-machines/trusted-launch
- https://learn.microsoft.com/azure/templates/microsoft.azurefleet/fleets#securityprofile

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.