VM No Public IP Adressen

<# ================================================================================ AZURE POWERSHELL SCRIPT - Nederlandse Baseline voor Veilige Cloud ================================================================================ .SYNOPSIS VM No Public IP Addresses .DESCRIPTION CIS Azure Foundations Benchmark - Control 7.11 Controleert of VMs geen publieke IP adressen hebben. .NOTES Filename: vm-no-public-ip-addresses.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 CIS Control: 7.11 #> #Requires -Version 5.1 #Requires -Modules Az.Accounts, Az.Compute, Az.Network [CmdletBinding()] param([Parameter()][switch]$Monitoring) $ErrorActionPreference = 'Stop' $PolicyName = "VM No Public IP Addresses" function Connect-RequiredServices { if (-not (Get-AzContext)) { Connect-AzAccount | Out-Null } } function Test-Compliance { $vms = Get-AzVM -ErrorAction SilentlyContinue $result = @{ TotalVMs = $vms.Count; WithPublicIP = 0 } foreach ($vm in $vms) { foreach ($nic in $vm.NetworkProfile.NetworkInterfaces) { $nicResource = Get-AzNetworkInterface -ResourceId $nic.Id -ErrorAction SilentlyContinue if ($nicResource.IpConfigurations.PublicIpAddress) { $result.WithPublicIP++ break } } } return $result } try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Public IP: $($r.WithPublicIP)" -ForegroundColor $(if ($r.WithPublicIP -eq 0) { 'Green' } else { 'Yellow' }) if ($r.WithPublicIP -gt 0) { Write-Host "`n⚠️ VMs met publieke IPs gevonden - overweeg Azure Bastion" -ForegroundColor Yellow } } else { $r = Test-Compliance Write-Host "`nPublic IPs: $($r.WithPublicIP)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } # ================================================================================ # Standaard Invoke-* Functions (Auto-generated) # ================================================================================ function Invoke-Implementation { <# .SYNOPSIS Implementeert de configuratie #> [CmdletBinding()] param() Invoke-Remediation } function Invoke-Monitoring { <# .SYNOPSIS Controleert de huidige configuratie status #> [CmdletBinding()] param() $Monitoring = $true try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Public IP: $($r.WithPublicIP)" -ForegroundColor $(if ($r.WithPublicIP -eq 0) { 'Green' } else { 'Yellow' }) if ($r.WithPublicIP -gt 0) { Write-Host "`n⚠️ VMs met publieke IPs gevonden - overweeg Azure Bastion" -ForegroundColor Yellow } } else { $r = Test-Compliance Write-Host "`nPublic IPs: $($r.WithPublicIP)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }