Checks/Backup/Test-AzureBackup.ps1
|
#Requires -Version 5.1 <# .SYNOPSIS NOT.4 - Datensicherung: Automatisierte Backups fuer VMs. .DESCRIPTION Verifies Azure Backup is configured and protecting all VMs. #> function Test-AzureBackup { [CmdletBinding()] param( [Parameter(Mandatory)][string]$ResourceGroup, [Parameter(Mandatory)][string]$VaultName, [Parameter(Mandatory)][string[]]$VmNames, [string]$SubscriptionId = '' ) $results = @() foreach ($vmName in $VmNames) { $response = Get-AzCliResponse -Arguments @("backup", "protection", "show", "--vault-name", $VaultName, "--resource-group", $ResourceGroup, "--container-name", $vmName, "--item-name", $vmName) -SubscriptionId $SubscriptionId if ($response.ExitCode -ne 0 -or -not $response.Output) { $results += [ComplianceResult]::new( 'NOT.4', "$vmName backup protection", 'Backup', [BsiCheckMode]::Remote, [BsiCheckStatus]::Error, [BsiSeverity]::High, "Could not retrieve backup protection for $vmName" ) $results[-1].CheckFunction = 'Test-AzureBackup' $results[-1].Remediation = "Enable Azure Backup for $vmName in vault $VaultName" continue } $backup = $response.Output | ConvertFrom-Json $state = $backup.properties.protectionState $pass = $state -eq 'Protected' $status = if ($pass) { [BsiCheckStatus]::Pass } else { [BsiCheckStatus]::Fail } $result = [ComplianceResult]::new( 'NOT.4', "$vmName backup protection", 'Backup', [BsiCheckMode]::Remote, $status, [BsiSeverity]::High, "ProtectionState: $state" ) $result.CheckFunction = 'Test-AzureBackup' $result.BsiReference = 'BSI-G-00763' if (-not $pass) { $result.Remediation = "Enable backup for $vmName — current state: $state" } $result.Metadata['vm'] = $vmName $results += $result } return $results } |