VM Beheerde Identiteiten

<# ================================================================================ AZURE POWERSHELL SCRIPT - Nederlandse Baseline voor Veilige Cloud ================================================================================ .SYNOPSIS VM Managed Identities Enabled .DESCRIPTION CIS Azure Foundations Benchmark - Control 7.7 Controleert of Managed Identities zijn ingeschakeld op VMs. .NOTES Filename: vm-managed-identities-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 CIS Control: 7.7 #> #Requires -Version 5.1 #Requires -Modules Az.Accounts, Az.Compute [CmdletBinding()] param([Parameter()][switch]$Monitoring) $ErrorActionPreference = 'Stop' $PolicyName = "VM Managed Identities Enabled" function Connect-RequiredServices { if (-not (Get-AzContext)) { Connect-AzAccount | Out-Null } } function Test-Compliance { $vms = Get-AzVM -ErrorAction SilentlyContinue $result = @{ TotalVMs = $vms.Count; WithManagedIdentity = 0 } foreach ($vm in $vms) { if ($vm.Identity.Type -ne 'None' -and $vm.Identity.Type -ne $null) { $result.WithManagedIdentity++ } } return $result } try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Managed Identity: $($r.WithManagedIdentity)" -ForegroundColor $(if ($r.WithManagedIdentity -gt 0) { 'Green' } else { 'Yellow' }) } else { $r = Test-Compliance Write-Host "`nManaged Identity: $($r.WithManagedIdentity)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } # ================================================================================ # Standaard Invoke-* Functions (Auto-generated) # ================================================================================ function Invoke-Implementation { <# .SYNOPSIS Implementeert de configuratie #> [CmdletBinding()] param() Invoke-Remediation } function Invoke-Monitoring { <# .SYNOPSIS Controleert de huidige configuratie status #> [CmdletBinding()] param() $Monitoring = $true try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Managed Identity: $($r.WithManagedIdentity)" -ForegroundColor $(if ($r.WithManagedIdentity -gt 0) { 'Green' } else { 'Yellow' }) } else { $r = Test-Compliance Write-Host "`nManaged Identity: $($r.WithManagedIdentity)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }