Security

AzSQLVMKit is lab software. Do not treat it as production-ready.

Defaults

• VM public IP is disabled by default.
• Sample securityRules is empty.
• Broad inbound RDP and SQL rules are rejected.
• Required YAML fields are schema-checked before Azure writes.
• New Key Vaults use RBAC authorization.
• Existing legacy access-policy vaults are rejected.
• Missing VM admin passwords require -GeneratePassword.
• Password output requires -ShowPassword.
• Azure-aware -WhatIf reads existing resources and reports drift before writes.

Network

Use Bastion as the RDP path:

network:
  publicIp:
    enabled: false

securityRules: []

If direct public access is enabled for a lab, restrict NSG sources to known IP ranges.

Secrets

Preferred flow:

1. Generate the VM admin password outside the toolkit.
2. Store it in Key Vault under keyVault.vmAdminPasswordSecretName.
3. Deploy without -GeneratePassword.

-GeneratePassword is for disposable labs only. -ShowPassword prints sensitive output and should be rare.

Key Vault

The script creates new vaults with RBAC authorization and resolves user or service-principal Azure contexts for RBAC assignment. It assigns:

• Key Vault Secrets Officer to the signed-in user.
• Key Vault Secrets User to the VM managed identity.

The VM identity uses that permission to retrieve the storage account key secret for the Azure Files mount.

Guest Setup

softwareInstalls.packages, softwareInstalls.installScript, and softwareInstalls.logonScript are trusted code inputs. The sample pins package versions for Git, PowerShell, Tabular Editor, and dbatools, then runs a small additional install script hook. Chocolatey package sha256 values are enforced when configured; PowerShell Gallery package checksums are rejected because the current install path cannot enforce them.

For stronger environments, set allowDynamicBootstrap: false, use a prepared image or internal package source, add Chocolatey bootstrap/package checksums where available, mirror installers, and review scripts before deployment.

Remaining Limits

• No formal penetration-test evidence.
• No automated guest software vulnerability scan.
• No live Azure integration test evidence in CI yet.
• Not every drift state is auto-corrected; unsafe drift is blocked or reported for manual remediation.