Cis Azure Database 2.10

2.10 Ensure 'Update Channel' is set to 'Stable' (Automated)

Profile Applicability

• Level 1

Description

Ensure all Azure Cache for Redis instances are configured to use the stable update channel.

Rationale

By using the stable update channel, organizations minimize the risk of introducing issues that may exist in preview update streams. The stable update channel improves security posture and reduces exposure to vulnerabilities.

Impact

Updates and new features will take longer to arrive when using the stable update channel.

Audit Procedure

Audit from Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. Under Settings, select Schedule updates.
4. Ensure Update Channel is set to Stable.
5. Repeat steps 1-4 for each cache.

Audit from Azure CLI

Run the following command to list caches:

az redis list

For each cache, run the following command to get the updateChannel setting:

az redis show --resource-group <resource-group> --name <cache> --query updateChannel

Ensure "Stable" is returned.

Audit from PowerShell

Run the following command to list caches:

Get-AzRedisCache

Run the following command to get the cache in a resource group with a given name:

$cache = Get-AzRedisCache -ResourceGroupName <resource-group> -Name <cache>

Run the following command to get the UpdateChannel setting:

$cache.UpdateChannel

Ensure Stable is returned.

Repeat for each cache.

Expected Result

The Update Channel should be set to Stable for each Azure Cache for Redis instance.

Remediation

Remediate from Azure Portal

1. Go to Azure Cache for Redis.
2. Select the name of a cache.
3. Under Settings, select Schedule updates.
4. Set Update Channel to Stable.
5. Select Save.
6. Repeat steps 1-5 for each cache requiring remediation.

Remediate from Azure CLI

For each cache requiring remediation, run the following command to set updateChannel to Stable:

az redis update --resource-group <resource-group> --name <cache> --set "updateChannel=Stable"

Remediate from PowerShell

For each cache requiring remediation, run the following command to set UpdateChannel to Stable:

Set-AzRedisCache -ResourceGroupName <resource-group> -Name <cache> -UpdateChannel Stable

Default Value

By default, 'Update Channel' is set to 'Stable'.

References

1. https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-administration#update-channel-and-schedule-updates

CIS Controls

MITRE ATT&CK Mappings