Ensure that the Basic/Consumption SKU is not used for Azure cloud resources that need to be monitored, such as production workloads. The following Azure resource types should use standard SKUs as a minimum:
- Public IP Addresses
- Network Load Balancers
- SQL Databases
- VPN Gateways
- Redis Cache Clusters
This rule resolution is part of the Conformity Security & Compliance tool for Azure.
excellence
Utilizing Basic or Consumption SKUs in Azure cloud may offer cost savings, but they come with notable limitations in terms of monitoring capabilities and support from Microsoft. These SKUs generally lack a Service-Level Agreement (SLA) and Microsoft typically does not provide support for them. As a result, it is strongly advised against using Basic/Consumption SKUs for production workloads.
Audit
To determine if the Basic/Consumption SKU is used for resources that need to be monitored, perform the following actions:
Remediation / Resolution
To upgrade the SKU for each Azure cloud resource used in production from Basic/Consumption SKU to Standard SKU, perform the following actions:
Each Azure cloud resource has its own process for upgrading from Basic/Consumption to Standard SKU. As an example, this section demonstrates how to upgrade the SKU for a public IP address used in production.References
- Azure Official Documentation
- Public IP addresses
- Create, change, or delete an Azure public IP address
- Upgrading a basic public IP address to Standard SKU - Guidance
- Azure CLI Documentation
- az graph query
- az network public-ip update