Control: Azure > CIS v3.0 > 08 - Virtual Machines > 08.07 - Ensure that Only Approved Extensions Are Installed

Configures auditing against a CIS Benchmark item.

Level: 1

For added security, only install organization-approved extensions on VMs.

Azure virtual machine extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. These extensions run with administrative privileges and could potentially access anything on a virtual machine. The Azure Portal and community provide several such extensions. Each organization should carefully evaluate these extensions and ensure that only those that are approved for use are actually implemented.

Resource Types

This control targets the following resource types:

Azure > Compute > Virtual Machine

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv3-0#/control/types/r0807

Category URI

tmod:@turbot/cis#/control/categories/v070201

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv3-0#/control/types/r0807") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv3-0#/control/types/r0807'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv3-0#/control/types/r0807"