[Feature Request]: Adjustment in the default extensions in the VM module

[Wojciech-Rozanski-CDT]

Feature Description

[Problem]
The current implementation for the VM module defaults with the following extensions in the extensions block:

[
  "NetworkWatcherAgent",
  "AzureMonitorAgent",
  "AzurePolicy",
  "AntiMalware"
]

However it seems Microsoft changed the extension naming. The AzurePolicy is now "divided" into two extensions:
AzurePolicyforWindows
AzurePolicyforLinux

Although technically the extension, the problem is when checking against the compliance with Azure Policy. As an example, there is a built-in policy initiative called Deploy prerequisites to enable Guest Configuration policies on virtual machines. Inside this initiative there are two policies, which deploy that extension. The logic in those policies checks for:

"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "AzurePolicyforWindows",

or

"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "AzurePolicyforLinux",

As a result, even though the correct extension is installed, the VMs are flagged as non-compliant because it's installed with a wrong name.

[Recommendation]
Easy fix: remove the AzurePolicy from the default. The extension is not critical and can be installed via different means.
Perfect fix: implement a logic that will install either AzurePolicyforWindows or AzurePolicyforLinux based on the OS type.

Use Case

Eliminating the possibility of non-compliance when deploying certain Azure Policies.

Additional Information

No response

Privacy Statement

• I agree

Code of Conduct

• I agree to follow this repository's Code of Conduct

[cjedro]

talked to @Wojciech-Rozanski-CDT because this has some flaws:

1. If we change the name of the extension it will get reinstalled which can have multiple issues:

• Powered-off VMs are failing
• in general extensions have a bad reputation of failing to uninstall

2. If we remove the extension from the default

• Operation Personell needs to verify if the extension is installed by some policy or is not needed
• have issues mentioned in 1.

3. If we remove it from the default and find a way to not delete the policy

• Users are not able to remove the extension using terraform

Recommendation:
Leave at is and remove the AzurePolicy extension from the extensions list in customer environments where the Azure Policy needs to be compliant - it will install itself and there is no diff or other problems