Azure Site Recovery Compliance Audit Framework

#!/bin/bash

# Script to perform basic compliance checks on an Azure VM in a DR environment

# --- Configuration ---
RESOURCE_GROUP="your-dr-resource-group"
VM_NAME="your-dr-vm-name"
SUBSCRIPTION_ID="your-azure-subscription-id"

# --- Authentication (Ensure Azure CLI is logged in: az login) ---
az account set --subscription "$SUBSCRIPTION_ID"

echo "Starting compliance checks for VM: $VM_NAME in Resource Group: $RESOURCE_GROUP"

# --- Check 1: OS Version (Example - adapt for your specific OS/compliance needs) ---
echo "\n--- Checking OS Version ---"
OS_INFO=$(az vm show --resource-group "$RESOURCE_GROUP" --name "$VM_NAME" --query 'storageProfile.osDisk.osType' -o tsv)
OS_VERSION=$(az vm show --resource-group "$RESOURCE_GROUP" --name "$VM_NAME" --query 'hardwareProfile.vmSize' -o tsv) # Placeholder, actual OS version needs agent or specific query

# In a real scenario, you'd query OS version via Azure VM Guest Agent extension or SSH
# For this example, we'll simulate a check
if [[ "$OS_INFO" == "Linux" ]]; then
    echo "OS Type: Linux (Simulated Check)"
    # Example: SSH into VM and run 'uname -r'
    # ssh user@$VM_NAME "uname -r"
else
    echo "OS Type: Windows (Simulated Check)"
    # Example: Use WinRM or Azure VM Guest Agent extension
fi

# --- Check 2: Network Security Group (NSG) Rules ---
echo "\n--- Checking Network Security Group Rules ---"
NIC_NAME=$(az vm show --resource-group "$RESOURCE_GROUP" --name "$VM_NAME" --query 'networkProfile.networkInterfaces[0].id' -o tsv | xargs -I {} basename {})
NSG_ID=$(az network nic show --resource-group "$RESOURCE_GROUP" --name "$NIC_NAME" --query 'networkSecurityGroup.id' -o tsv)

if [ -z "$NSG_ID" ]; then
    echo "No NSG associated with NIC: $NIC_NAME. Compliance Risk!"
else
    echo "NSG ID: $NSG_ID"
    echo "Checking inbound rules..."
    az network nsg rule list --resource-group "$RESOURCE_GROUP" --nsg-name "$(basename "$NSG_ID")" --query "[?access=='Allow' && direction=='Inbound'].{
        Name:name, Priority:priority, Protocol:protocol, SourcePortRange:sourcePortRange, DestinationPortRange:destinationPortRange, SourceAddressPrefix:sourceAddressPrefix
    }" -o table
    # Add checks for specific allowed ports/protocols based on compliance requirements
fi

# --- Check 3: Disk Encryption Status ---
echo "\n--- Checking Disk Encryption Status ---"
# This requires Azure Disk Encryption extension or Azure Storage Service Encryption checks
# For simplicity, we'll check if ADE is enabled. Real check needs more specific queries.

# Example for Azure Disk Encryption (requires extension to be installed and configured)
# AZURE_DISK_ENCRYPTION_ENABLED=$(az vm extension list --resource-group "$RESOURCE_GROUP" --vm-name "$VM_NAME" --query "[?name=='AzureDiskEncryption'].autoUpgradeMinorVersion" -o tsv)
# if [[ "$AZURE_DISK_ENCRYPTION_ENABLED" == "True" ]]; then
#     echo "Azure Disk Encryption is enabled."
# else
#     echo "Azure Disk Encryption is NOT enabled. Compliance Risk!"
# fi

# For Storage Service Encryption (SSE), it's often enabled by default for managed disks.
echo "Managed disks typically use Storage Service Encryption (SSE) by default. Verify specific compliance requirements regarding encryption keys."

# --- Check 4: Required Services Running (Simulated) ---
echo "\n--- Checking Critical Services Running (Simulated) ---"
# This would typically involve connecting to the VM and checking service status.
# For example, using 'az vm run-command invoke' with a script.
# Example: az vm run-command invoke --resource-group $RESOURCE_GROUP --name $VM_NAME --command-id RunShellScript --scripts 'systemctl status nginx'

echo "Simulating check for critical SaaS services (e.g., web server, database). Critical services should be running."

echo "\nCompliance checks completed. Review output for any deviations."

exit 0