nuclei-templates/cloud/azure/virtualmachines/azure-vm-standard-ssd-requi...

55 lines
2.3 KiB
YAML

id: azure-vm-standard-ssd-required
info:
name: Azure VM Premium SSD Not Required
author: princechaddha
severity: high
description: |
Ensure that your Microsoft Azure virtual machines (VMs) are using Standard SSD disk volumes instead of Premium SSD volumes for cost-effective storage that fits a broad range of workloads from web servers to enterprise applications that need consistent performance at lower IOPS levels. Unless you are running mission-critical applications or performance sensitive workloads that need more than 6000 IOPS or 750 MiB/s of throughput per VM disk volume, Cloud Conformity recommends converting your Premium SSD volumes to Standard SSD in order to lower the cost of your Azure monthly bill.
impact: |
Using Premium SSD volumes when not required can significantly increase the cost without providing necessary benefits for non-critical workloads, leading to inefficient resource utilization and budget overruns.
remediation: |
Convert any Premium SSD volumes to Standard SSD unless the workload requires high performance disk specifications. This can be achieved through Azure's portal or via CLI commands.
reference:
- https://docs.microsoft.com/en-us/azure/virtual-machines/disks-types
tags: cloud,devops,azure,microsoft,virtual-machine,azure-cloud-config
flow: |
code(1);
for (let VMData of iterate(template.vmList)) {
VMData = JSON.parse(VMData);
set("ids", VMData.id);
code(2);
}
self-contained: true
code:
- engine:
- sh
- bash
source: |
az vm list --query '[*].{"id":id}'
extractors:
- type: json
name: vmList
internal: true
json:
- '.[]'
- engine:
- sh
- bash
source: |
az vm show --ids "$ids" --query 'storageProfile.{"osDiskStorageType":osDisk.managedDisk.storageAccountType,"dataDiskStorageType":dataDisks[*].managedDisk.storageAccountType}'
matchers-condition: and
matchers:
- type: word
words:
- 'Premium_LRS'
extractors:
- type: dsl
dsl:
- 'ids + " is using Premium SSD volumes for OS or data disks which is not recommended for its current workload"'
# digest: 4b0a00483046022100d1900765adf3ea2a7c6f14ba87e4d31ee315925bc879582c501b28d12a613018022100c0127ba646b4da264ae0d1dc27004278f30fb1058c44c85cdc5babe2800cbf5f:922c64590222798bb761d5b6d8e72950