Enable DDoS Protection Standard Monitoring for Public Virtual Networks

More Info:

Ensure that monitoring of DDoS protection at the Azure virtual network level is enabled.

Risk Level

High

Address

Operational Maturity, Security

Compliance Standards

• Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration “Enable DDoS Protection Standard Monitoring for Public Virtual Networks” in Azure using the Azure console:

1. Login to the Azure Portal (https://portal.azure.com/)
2. Select the subscription and resource group that contains the virtual network you want to protect.
3. In the Azure portal, search for “DDoS protection plans” in the search bar.
4. Select “DDoS protection plans” from the search results.
5. Click on ”+ Add” to create a new DDoS protection plan.
6. In the “Basics” tab, enter a name for the plan and select the subscription and resource group that contains the virtual network you want to protect.
7. In the “Settings” tab, select “Standard” as the DDoS protection plan tier.
8. In the “Review + create” tab, review the settings and click on “Create” to create the DDoS protection plan.
9. Once the DDoS protection plan is created, go to the virtual network that you want to protect.
10. In the virtual network’s “Settings” menu, select “DDoS protection”.
11. Under “DDoS protection plan”, select the DDoS protection plan that you created in step 5.
12. Click on “Save” to save the changes.

That’s it! You have now enabled DDoS Protection Standard Monitoring for Public Virtual Networks in Azure.

Using CLI

To remediate the misconfiguration “Enable DDoS Protection Standard Monitoring for Public Virtual Networks” in AZURE using AZURE CLI, follow the below steps:

Step 1: Open the AZURE CLI on your local machine or use the AZURE Cloud Shell.

Step 2: Login to your AZURE account using the below command:

az login

Step 3: Once you are logged in, set the default subscription using the below command:

az account set --subscription <subscription_id>

Step 4: To enable DDoS Protection Standard Monitoring for Public Virtual Networks, run the below command:

az network ddos-protection create --name <ddos_protection_name> --resource-group <resource_group_name> --location <location_name> --tags <tags>

Replace the below placeholders with appropriate values:

• <ddos_protection_name>: Name of the DDoS protection plan.
• <resource_group_name>: Name of the resource group where the DDoS protection plan needs to be created.
• <location_name>: Location where the DDoS protection plan needs to be created.
• <tags>: Tags for the DDoS protection plan.

Note: If you want to enable DDoS protection for an existing virtual network, you need to update the virtual network configuration to associate it with the DDoS protection plan.

Step 5: Verify the DDoS Protection Standard Monitoring is enabled for the Public Virtual Network by running the below command:

az network vnet list --resource-group <resource_group_name> --query [*].ddosProtectionPlan.id

This will return the DDoS protection plan ID associated with the virtual network. If it returns null, it means DDoS protection is not enabled for the virtual network.

With these steps, you have successfully remediated the misconfiguration “Enable DDoS Protection Standard Monitoring for Public Virtual Networks” in AZURE using AZURE CLI.

Using Python

To remediate the misconfiguration “Enable DDoS Protection Standard Monitoring for Public Virtual Networks” in Azure using Python, you can follow the below steps:

1. Import the necessary modules:

from azure.mgmt.network import NetworkManagementClient
from azure.common.credentials import ServicePrincipalCredentials

2. Set the credentials:

subscription_id = '<subscription_id>'
credentials = ServicePrincipalCredentials(
    client_id='<client_id>',
    secret='<client_secret>',
    tenant='<tenant_id>'
)

3. Instantiate the NetworkManagementClient:

network_client = NetworkManagementClient(
    credentials,
    subscription_id
)

4. Get the list of public IP addresses:

public_ips = network_client.public_ip_addresses.list_all()

5. For each public IP address, check if DDoS protection is enabled. If not, enable it:

for public_ip in public_ips:
    if not public_ip.ddos_settings:
        public_ip.ddos_settings = DdosSettings(
            protection_coverage='Standard',
            protected_ip=True
        )
        network_client.public_ip_addresses.create_or_update(
            resource_group_name='<resource_group_name>',
            public_ip_address_name=public_ip.name,
            parameters=public_ip
        )

This code will check for all the public IP addresses in your Azure subscription and enable DDoS protection standard monitoring for each public IP address that does not already have it enabled.

Note: Make sure to replace the placeholders like <subscription_id>, <client_id>, <client_secret>, <tenant_id>, <resource_group_name> with the appropriate values for your Azure environment.

Using Terraform

# Replace SUBSCRIPTION_ID or use data.azurerm_subscription as shown
data "azurerm_subscription" "current" {
  subscription_id = "SUBSCRIPTION_ID" # <-- set to your subscription ID
}

# Assign the built-in Azure Policy that enables/monitors
# DDoS Protection Standard for public virtual networks
resource "azurerm_policy_assignment" "ddos_protection_standard_monitoring" {
  name         = "ddos-protection-standard-monitoring"
  display_name = "Enable DDoS Protection Standard Monitoring for Public Virtual Networks"

  # Scope can be the subscription or a management group; subscription is typical
  scope = data.azurerm_subscription.current.id

  # Set this to the ID of the built-in policy (or initiative) used by
  # Microsoft Defender for Cloud for DDoS Standard monitoring, for example:
  # "/providers/Microsoft.Authorization/policyDefinitions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
  # or an initiative:
  # "/providers/Microsoft.Authorization/policySetDefinitions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
  policy_definition_id = "DDOS_POLICY_DEFINITION_OR_INITIATIVE_ID" # <-- replace with the correct ID

  enforcement_mode = "Default"

  # Add parameters here if your chosen policy/initiative requires them, e.g.:
  # parameters = jsonencode({
  #   effect = { value = "AuditIfNotExists" }
  # })
}

This does not force replacement of any existing virtual networks; it only adds a new policy assignment.

For verification, terraform plan should show creation of a single azurerm_policy_assignment.ddos_protection_standard_monitoring resource with policy_definition_id set to the DDoS monitoring policy/initiative ID and no changes to existing resources.