Virtual Machine should enable vTPM

Medium Azure General vm-virtual-machine-enable-vtpm

Applies to

Microsoft.Compute/virtualMachines

What CGPulse checks

A resource passes this rule when securityProfile.vTpmEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable Trusted Launch at VM creation to protect against boot-level rootkits and firmware attacks. See: https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch

CLI

az vm show --ids "{id}" --query "securityProfile" -o json

Bicep

param location string = resourceGroup().location
param vmSize string = 'Standard_D2s_v5'

resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = {{
  name: '{name}-trustedlaunch'
  location: location
  properties: {{
    hardwareProfile: {{ vmSize: vmSize }}
    securityProfile: {{
      uefiSettings: {{
        secureBootEnabled: true
        vTpmEnabled: true
      }}
      securityType: 'TrustedLaunch'
    }}
    // TODO: Configure storageProfile, osProfile, networkProfile from your existing VM
  }}
}}

Terraform

# Trusted Launch cannot be changed after VM creation
resource "azurerm_linux_virtual_machine" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  size                = "Standard_D2s_v5"
  secure_boot_enabled = true
  vtpm_enabled        = true
  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan