Compute autoscale notifications remediation

Using Console

To remediate the misconfiguration of enabling Autoscale Notifications in Azure, you can follow the below steps using the Azure console:

Go to the Azure portal and navigate to the Autoscale settings of the resource group that you want to remediate.
In the Autoscale settings, select the resource that you want to enable notifications for.
Click on the “Notifications” tab, and then click “Add notification”.
Select the notification type that you want to use. You can choose from Email, SMS, Webhook, or Azure Function.
Enter the details of the notification, such as the email address or phone number.
Click “Save” to save the notification.
Repeat steps 4-6 to add additional notifications if needed.
Once you have added all the notifications that you need, click “Save” to save the Autoscale settings.

By following these steps, you will be able to remediate the misconfiguration of enabling Autoscale Notifications in Azure.

Using CLI

To remediate the misconfiguration of enabling Autoscale Notifications in AZURE using AZURE CLI, you can follow the below step by step instructions:

Open the AZURE CLI and login to your AZURE account using the below command: az login
Once you are logged in, set the subscription where you want to enable the Autoscale Notifications using the below command: az account set --subscription <subscription_id>
Now, enable the Autoscale Notifications for your AZURE account using the below command: az monitor autoscale update --resource-group <resource_group_name> --name <autoscale_setting_name> --email-administrator <email_address> --verbose Here, replace the <resource_group_name> with the name of the resource group where your Autoscale setting is located, <autoscale_setting_name> with the name of the Autoscale setting that you want to update and <email_address> with the email address where you want to receive the notifications.
After running the above command, you will receive a confirmation message that the Autoscale Notifications have been enabled for your account.

By following the above steps, you can remediate the misconfiguration of enabling Autoscale Notifications in AZURE using AZURE CLI.

Using Python

To remediate the misconfiguration of enabling autoscale notifications in Azure using Python, you can follow the below steps:

Import the necessary libraries:

from azure.mgmt.monitor import MonitorManagementClient
from azure.common.credentials import ServicePrincipalCredentials

Set up the credentials for authentication:

subscription_id = '<Subscription ID>'
client_id = '<Client ID>'
client_secret = '<Client Secret>'
tenant_id = '<Tenant ID>'

credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=client_secret,
    tenant=tenant_id
)

Instantiate the MonitorManagementClient:

monitor_client = MonitorManagementClient(credentials, subscription_id)

Get the autoscale settings:

autoscale_settings = monitor_client.autoscale_settings.list()

For each autoscale setting, check if notifications are enabled. If not, enable them:

for setting in autoscale_settings:
    if not setting.notification:
        setting.notification = {}
        setting.notification.email = {}
        setting.notification.email.send_to_subscription_administrator = True
        monitor_client.autoscale_settings.create_or_update(
            resource_group_name=setting.id.split('/')[4],
            autoscale_setting_name=setting.name,
            parameters=setting
        )

Verify that notifications have been enabled by checking the notification attribute of each autoscale setting.

By following these steps, you can remediate the misconfiguration of enabling autoscale notifications in Azure using Python.

Using Terraform

# Existing VM Scale Set (example)
resource "azurerm_linux_virtual_machine_scale_set" "VMSS_NAME" {
  name                = "VMSS_NAME"
  resource_group_name = azurerm_resource_group.RG_NAME.name
  location            = azurerm_resource_group.RG_NAME.location
  sku                 = "Standard_DS2_v2"
  instances           = 2
  # ...other required arguments...
}

# Autoscale configuration with notifications for this VM Scale Set
resource "azurerm_monitor_autoscale_setting" "VMSS_NAME_autoscale" {
  name                = "VMSS_NAME-autoscale"
  resource_group_name = azurerm_resource_group.RG_NAME.name
  location            = azurerm_resource_group.RG_NAME.location
  target_resource_id  = azurerm_linux_virtual_machine_scale_set.VMSS_NAME.id

  profiles {
    name = "default-profile"

    capacity {
      default = 2         # SUBSTITUTE: DEFAULT_INSTANCE_COUNT
      minimum = 1         # SUBSTITUTE: MIN_INSTANCE_COUNT
      maximum = 5         # SUBSTITUTE: MAX_INSTANCE_COUNT
    }

    # Example scale-out rule (SUBSTITUTE threshold & metric as needed)
    rule {
      metric_trigger {
        metric_name        = "Percentage CPU"
        metric_resource_id = azurerm_linux_virtual_machine_scale_set.VMSS_NAME.id
        time_grain         = "PT1M"
        statistic          = "Average"
        time_window        = "PT5M"
        time_aggregation   = "Average"
        operator           = "GreaterThan"
        threshold          = 75  # SUBSTITUTE: SCALE_OUT_THRESHOLD
      }

      scale_action {
        direction = "Increase"
        type      = "ChangeCount"
        value     = "1"
        cooldown  = "PT5M"
      }
    }

    # Example scale-in rule
    rule {
      metric_trigger {
        metric_name        = "Percentage CPU"
        metric_resource_id = azurerm_linux_virtual_machine_scale_set.VMSS_NAME.id
        time_grain         = "PT1M"
        statistic          = "Average"
        time_window        = "PT5M"
        time_aggregation   = "Average"
        operator           = "LessThan"
        threshold          = 30  # SUBSTITUTE: SCALE_IN_THRESHOLD
      }

      scale_action {
        direction = "Decrease"
        type      = "ChangeCount"
        value     = "1"
        cooldown  = "PT5M"
      }
    }
  }

  notification {
    email {
      send_to_subscription_administrator    = true
      send_to_subscription_co_administrator = true
      custom_emails = [
        "AUTOSCALE_ALERTS_EMAIL@example.com", # SUBSTITUTE: ADDRESSES TO NOTIFY
      ]
    }

    webhook {
      service_uri = "https://WEBHOOK_ENDPOINT_URL" # SUBSTITUTE: WEBHOOK URL
      properties = {
        source = "vmss-autoscale"
        env    = "ENVIRONMENT_NAME"
      }
    }
  }

  tags = {
    environment = "ENVIRONMENT_NAME" # SUBSTITUTE
  }
}

This change adds a separate autoscale setting with email and webhook notifications and does not force replacement of the existing virtual machine scale set. After updating the configuration, terraform plan should show a new azurerm_monitor_autoscale_setting resource being created and no changes requiring replacement of the VM scale set.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Compute autoscale notifications remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation