Homepage
About Snyk

ExpressRoute virtual network gateway does not use an availability zone SKU Affecting Network service in Azure

Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    Network / Redundancy

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Controls CSA-CCM
  • Snyk ID SNYK-CC-00461
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Consider deploying ExpressRoute gateways with an availability zone SKU to improve reliability of virtual network gateways.

How to fix?

When properties.gatewayType is set to ExpressRoute, set properties.sku.tier to ErGw1AZ, ErGw2AZ, or ErGw3AZ.

Example Configuration

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "resources": [
    {
      "type": "Microsoft.Network/virtualNetworkGateways",
      "apiVersion": "2021-03-01",
      "name": "arm-461-allowed2",
      "location": "West Europe",
      "properties": {
        "gatewayType": "ExpressRoute",
        "sku": {
          "name": "ErGw3AZ",
          "tier": "ErGw3AZ"
        }
      }
    }
  ]
}