Azure / Azure/PSRule.Rules.Azure
[RULE] Azure Fleets should use secure boot
- Dominant language
- PowerShell
- Stars
- 447
- Forks
- 109
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 23
Description
### Existing rule
_No response_
### Suggested rule
Fleets `Microsoft.AzureFleet/fleets` should use secure boot by setting the property `properties.computeProfile.baseVirtualMachineProfile.securityProfile.securityType` = `TrustedLaunch` and `properties.computeProfile.baseVirtualMachineProfile.securityProfile.uefiSettings.secureBootEnabled` = `true`.
At the root of Trusted Launch is Secure Boot for your VM. Secure Boot, which is implemented in platform firmware, protects against the installation of malware-based rootkits and boot kits. Secure Boot works to ensure that only signed operating systems and drivers can boot. It establishes a "root of trust" for the software stack on your VM.
With Secure Boot enabled, all OS boot components (boot loader, kernel, kernel drivers) require trusted publishers signing. Both Windows and select Linux distributions support Secure Boot. If Secure Boot fails to authenticate that the image is signed with a trusted publisher, the VM fails to boot.
### Pillar
Security
### Additional context
Setting the security type to `ConfidentialVM` is also acceptable.
- https://learn.microsoft.com/azure/virtual-machines/trusted-launch
- https://learn.microsoft.com/azure/templates/microsoft.azurefleet/fleets#securityprofile
Contributor guide
Assessment
This issue has not been assessed yet.