> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Check for Zone-Redundant Virtual Machine Scale Sets ### More Info: Ensure that all your Microsoft Azure virtual machine scale sets are using zone-redundant availability configurations instead of single-zone (zonal) configurations, to deploy and load balance virtual machines (VMs) across multiple Availability Zones (AZs) in order to protect your Azure scale sets from datacenter-level failures. ### Risk Level High ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HIPAA * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate Zone-Redundant Virtual Machine Scale Sets misconfiguration in Azure: 1. Log in to the Azure portal ([https://portal.azure.com](https://portal.azure.com)). 2. Navigate to the Virtual Machine Scale Sets resource that needs to be remediated. 3. In the left-hand menu, select "Settings" and then select "Properties". 4. In the "Properties" pane, scroll down to the "Availability" section. 5. In the "Availability" section, check if "Zone Redundancy" is set to "Enabled". If it is enabled, then the Scale Set is configured to use Zone-Redundant Virtual Machines. 6. To remediate this misconfiguration, disable the "Zone Redundancy" option by toggling the switch to "Disabled". 7. Once the "Zone Redundancy" option is disabled, click on the "Save" button at the top of the "Properties" pane to save the changes. Congratulations! You have successfully remediated the Zone-Redundant Virtual Machine Scale Sets misconfiguration in Azure. # To remediate the Zone-Redundant Virtual Machine Scale Sets misconfiguration in Azure using Azure CLI, follow these steps: 1. Open the Azure CLI in your terminal or command prompt. 2. Login to your Azure account using the following command: ``` az login ``` 3. Once you are logged in, set the subscription to the one where the affected Virtual Machine Scale Set is located using the following command: ``` az account set --subscription ``` 4. Check the current configuration of the Virtual Machine Scale Set using the following command: ``` az vmss show --name --resource-group ``` 5. If the Virtual Machine Scale Set is configured for Zone-Redundancy, you can remediate it by disabling the Zone-Redundant deployment using the following command: ``` az vmss update --name --resource-group --set singlePlacementGroup=false ``` 6. Once the command executes successfully, the Virtual Machine Scale Set will be updated to disable the Zone-Redundant deployment. 7. Verify the updated configuration of the Virtual Machine Scale Set using the following command: ``` az vmss show --name --resource-group ``` 8. You have now successfully remediated the Zone-Redundant Virtual Machine Scale Sets misconfiguration in Azure using Azure CLI. To remediate the Zone-Redundant Virtual Machine Scale Sets misconfiguration in Azure using Python, follow these steps: 1. Import the necessary modules: ``` from azure.mgmt.compute import ComputeManagementClient from azure.identity import DefaultAzureCredential ``` 2. Instantiate the ComputeManagementClient and DefaultAzureCredential objects: ``` credential = DefaultAzureCredential() compute_client = ComputeManagementClient(credential, subscription_id) ``` 3. Use the `list` method of the `compute_client.virtual_machine_scale_sets` object to get a list of all Virtual Machine Scale Sets in the subscription: ``` vmss_list = compute_client.virtual_machine_scale_sets.list() ``` 4. For each Virtual Machine Scale Set in the list, check if it is configured to use Zone-Redundant deployment by checking the `zones` property: ``` for vmss in vmss_list: if vmss.zones is not None: # Zone-Redundant deployment is enabled # Remediation steps go here ``` 5. To remediate the issue, update the Virtual Machine Scale Set to use a non-Zone-Redundant deployment by setting the `zones` property to `None`: ``` vmss.zones = None compute_client.virtual_machine_scale_sets.create_or_update(resource_group_name, vmss_name, vmss) ``` 6. Repeat steps 4 and 5 for all Virtual Machine Scale Sets that have Zone-Redundant deployment enabled. Note: Make sure to replace the `subscription_id`, `resource_group_name`, and `vmss_name` variables with the appropriate values for your Azure environment. Also, ensure that you have the necessary permissions to modify Virtual Machine Scale Sets in your subscription. ```hcl theme={null} resource "azurerm_linux_virtual_machine_scale_set" "EXAMPLE_VMSS" { name = "EXAMPLE_VMSS_NAME" resource_group_name = azurerm_resource_group.EXAMPLE_RG.name location = azurerm_resource_group.EXAMPLE_RG.location sku = "Standard_D2s_v3" instances = 3 # Make the scale set zone-redundant by using multiple Availability Zones zones = [ "1", "2", "3", ] upgrade_mode = "Automatic" admin_username = "EXAMPLE_ADMIN_USERNAME" disable_password_authentication = true admin_ssh_key { username = "EXAMPLE_ADMIN_USERNAME" public_key = file("PATH_TO_PUBLIC_SSH_KEY") } source_image_reference { publisher = "Canonical" offer = "0001-com-ubuntu-server-focal" sku = "20_04-lts" version = "latest" } os_disk { storage_account_type = "Standard_LRS" caching = "ReadWrite" } network_interface { name = "EXAMPLE_NIC_NAME" primary = true ip_configuration { name = "EXAMPLE_IP_CONFIG" primary = true subnet_id = azurerm_subnet.EXAMPLE_SUBNET.id } } } ``` Replace: * `EXAMPLE_VMSS_NAME` with your VM scale set name. * `EXAMPLE_RG` with your resource group resource name. * `EXAMPLE_ADMIN_USERNAME` with your admin username. * `PATH_TO_PUBLIC_SSH_KEY` with the path to your SSH public key file. * `EXAMPLE_NIC_NAME`, `EXAMPLE_IP_CONFIG`, and `EXAMPLE_SUBNET` with your actual resource names/IDs. Changing `zones` from a single zone (e.g., `["1"]`) to multiple zones (e.g., `["1","2","3"]`) forces replacement of the scale set and its instances; plan for downtime or blue/green deployment. Verification: `terraform plan` should show an update to the VMSS with `zones` changing from a single-element list (or `null`) to the multi-zone list you configured, with the resource marked for replacement.