> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Virtual Machines Should Have Sufficient Instant Restore Retention Period

### More Info:

Ensure that your Microsoft Azure virtual machines (VMs) have a sufficient snapshot instant restore retention period configured for data security and internal compliance. Instant recovery snapshots are stored together with the VM disk volumes to speed up the recovery point creation and the restore operations. Azure VM instant restore retention period can range from a minimum of 1 day to a maximum of 5 days.

### Risk Level

Low

### Address

Reliability, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" in Azure:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. In the left-hand menu, click on "Virtual machines".
        3. Select the virtual machine that you want to remediate.
        4. In the virtual machine overview page, click on "Disks" under the "Settings" section.
        5. Select the managed disk that you want to remediate.
        6. Under the "Settings" section, click on "Backup".
        7. In the "Backup policy" section, click on "Edit".
        8. In the "Retention" section, set the "Instant restore snapshot retention range" to the desired value (e.g. 7 days).
        9. Click on "Save" to save the changes.

        By following these steps, you have successfully remediated the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" for Azure using Azure CLI, you can follow the below steps:

        1. Open Azure CLI and login to your Azure account using the command `az login`.

        2. Once you are logged in, check the current retention period of the virtual machine using the command `az backup protection show --backup-management-type AzureIaasVM --query "items[].{VMName:name,RetentionPeriod:properties.instantRP.retentionPeriodInDays}"`.

        3. If the retention period is less than the required duration, update the retention period using the command `az backup protection update-for-vm --resource-group <resource-group-name> --vault-name <vault-name> --vm-name <vm-name> --policy-name <policy-name> --retention-in-days <retention-period>`.

           Note: Replace the placeholders `<resource-group-name>`, `<vault-name>`, `<vm-name>`, `<policy-name>` and `<retention-period>` with the actual values.

        4. Verify that the retention period has been updated by running the command `az backup protection show --backup-management-type AzureIaasVM --query "items[].{VMName:name,RetentionPeriod:properties.instantRP.retentionPeriodInDays}"`.

        5. Once the retention period has been updated, the remediation is complete.

        By following the above steps, you can remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" for Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Virtual Machines Should Have Sufficient Instant Restore Retention Period" in Azure using Python, you can use the Azure Python SDK to update the retention period of the virtual machine backups.

        Here are the steps to remediate the misconfiguration:

        1. Install the Azure Python SDK by running the following command:

           ```
           pip install azure-mgmt-compute
           ```

        2. Authenticate with Azure by providing your subscription ID, tenant ID, client ID, and client secret. You can do this by creating a Service Principal and granting it the required permissions.

           ```
           from azure.common.credentials import ServicePrincipalCredentials

           subscription_id = '<your-subscription-id>'
           credentials = ServicePrincipalCredentials(
               client_id='<your-client-id>',
               secret='<your-client-secret>',
               tenant='<your-tenant-id>'
           )
           ```

        3. Use the `ComputeManagementClient` class from the Azure Python SDK to get a list of all the virtual machines in your subscription.

           ```
           from azure.mgmt.compute import ComputeManagementClient

           compute_client = ComputeManagementClient(credentials, subscription_id)
           vm_list = compute_client.virtual_machines.list_all()
           ```

        4. For each virtual machine in the list, use the `BackupManagementClient` class from the Azure Python SDK to get the current retention policy for the virtual machine backups.

           ```
           from azure.mgmt.recoveryservicesbackup import BackupManagementClient

           backup_client = BackupManagementClient(credentials, subscription_id)
           for vm in vm_list:
               backup_policy = backup_client.backup_policies.get(
                   '<your-resource-group>',
                   '<your-backup-policy-name>'
               )
               retention_period = backup_policy.instant_rp.retention_period_in_days
           ```

        5. If the retention period is less than the recommended value, update the retention policy using the `BackupManagementClient` class.

           ```
           if retention_period < <recommended-retention-period>:
               backup_policy.instant_rp.retention_period_in_days = <recommended-retention-period>
               backup_client.backup_policies.create_or_update(
                   '<your-resource-group>',
                   '<your-backup-policy-name>',
                   backup_policy
               )
           ```

        6. Run the script periodically to ensure that the retention policies of all virtual machines are up-to-date.

        Note: Replace the placeholders `<your-subscription-id>`, `<your-client-id>`, `<your-client-secret>`, `<your-tenant-id>`, `<your-resource-group>`, `<your-backup-policy-name>`, and `<recommended-retention-period>` with your own values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Backup policy used by the VM; ensure instant restore retention is at least 5 days
        resource "azurerm_backup_policy_vm" "VM_BACKUP_POLICY" {
          name                = "VM_BACKUP_POLICY_NAME"                    # replace with your policy name
          resource_group_name = "RECOVERY_VAULT_RESOURCE_GROUP_NAME"       # replace with the RG of the recovery vault
          recovery_vault_name = "RECOVERY_SERVICES_VAULT_NAME"             # replace with your vault name

          backup {
            frequency = "Daily"
            time      = "23:00"
          }

          retention_daily {
            count = 30
          }

          # This is the setting that fixes the finding (must be between 1 and 5; rule requires 5)
          instant_restore_retention_days = 5
        }

        # VM protected by the above backup policy (for context on how it attaches)
        resource "azurerm_backup_protected_vm" "VM_BACKUP_PROTECTION" {
          resource_group_name = "RECOVERY_VAULT_RESOURCE_GROUP_NAME"       # same as vault RG
          recovery_vault_name = "RECOVERY_SERVICES_VAULT_NAME"
          source_vm_id        = azurerm_windows_virtual_machine.VM_NAME.id # or azurerm_linux_virtual_machine
          backup_policy_id    = azurerm_backup_policy_vm.VM_BACKUP_POLICY.id
        }
        ```

        This change is an in-place update of the backup policy and does not force replacement of the VM or the policy resource.

        Verification: `terraform plan` should show an update to `azurerm_backup_policy_vm.VM_BACKUP_POLICY` with `instant_restore_retention_days` changing from its current value to `5`, and no replacements.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/en-us/azure/backup/backup-instant-restore-capability](https://docs.microsoft.com/en-us/azure/backup/backup-instant-restore-capability)