Merge pull request #270173 from sumit-kalra/sukalra/aibbestpractice

Documenting best practices for Azure VM Image Builder

Author: American-Dipper

articles/virtual-machines/TOC.yml

@@ -742,6 +742,9 @@
       - name: Troubleshoot
         displayName: Image builder, images, building
         href: ./linux/image-builder-troubleshoot.md
+      - name: Best practices
+        displayName: Image builder, images, building, best practices
+        href: image-builder-best-practices.md
       - name: Image Builder Reliability
         displayName: Image builder, images, building, reliability, resiliency, recovery
         href: ../reliability/reliability-image-builder.md?toc=/azure/virtual-machines/toc.json&bc=/azure/virtual-machines/breadcrumb/toc.json

articles/virtual-machines/image-builder-best-practices.md

@@ -0,0 +1,28 @@
+---
+title: Best practices
+description: This article describes best practices to be followed while using Azure VM Image Builder.
+author: sumit-kalra
+ms.service: virtual-machines
+ms.topic: conceptual
+ms.date: 03/25/2024
+ms.reviewer: mattmcinnes
+ms.subservice: image-builder
+ms.custom: references_regions
+---
+
+# Azure VM Image Builder best practices
+
+**Applies to:** :heavy_check_mark: Linux VMs :heavy_check_mark: Windows VMs :heavy_check_mark: Flexible scale sets :heavy_check_mark: Uniform scale sets
+
+This article describes best practices to be followed while using Azure VM Image Builder (AIB).
+
+- To prevent image templates from being accidentally deleted, use resource locks at the image template resource level. For more information, see [Protect your Azure resources with a lock](../azure-resource-manager/management/lock-resources.md).
+- Make sure your image templates are set up for disaster recovery by following [reliability recommendation for AIB](../reliability/reliability-image-builder.md?toc=/azure/virtual-machines/toc.json&bc=/azure/virtual-machines/breadcrumb/toc.json).
+- Set up AIB [triggers](image-builder-triggers-how-to.md) to automatically rebuild your images and keep them updated.
+- Enable [VM Boot Optimization](vm-boot-optimization.md) in AIB to improve the create time for your VMs.
+- Follow the [principle of least privilege](/entra/identity-platform/secure-least-privileged-access) for your AIB resources.
+  - **Image Template**: A principal that has access to your image template is able to run, delete, or tamper with it. Having this access, in turn, allows the principal to change the images created by that image template.
+  - **Staging Resource Group**: AIB uses a staging resource group in your subscription to customize your VM image. You must consider this resource group as sensitive and restrict access to this resource group only to required principals. Since the process of customizing your image takes place in this resource group, a principal with access to the resource group is able to compromise the image building process - for example, by injecting malware into the image. AIB also delegates privileges associated with the Template identity and Build VM identity to resources in this resource group. Hence, a principal with access to the resource group is able to get access to these identities. Further, AIB maintains a copy of your customizer artifacts in this resource group. Hence, a principal with access to the resource group is able to inspect these copies.
+  - **Template Identity**: A principal with access to your template identity is able to access all resources that the identity has permissions for. This includes your customizer artifacts (for example, shell and PowerShell scripts), your distribution targets (for example, an Azure Compute Gallery image version), and your Virtual Network. Hence, you must provide only the minimum required privileges to this identity.
+  - **Build VM Identity**: A principal with access to your build VM identity is able to access all resources that the identity has permissions for. This includes any artifacts and Virtual Network that you might be using from within the Build VM using this identity. Hence, you must provide only the minimum required privileges to this identity.
+- If you're distributing to Azure Compute Gallery (ACG), then also follow [best practices for ACG resources](azure-compute-gallery.md#best-practices).

articles/virtual-machines/security-isolated-image-builds-image-builder.md

@@ -51,6 +51,9 @@ Your image builds will automatically be migrated to Isolated Image Builds and yo
 >
 > If you have Azure Policies applying DDoS protection plans to any newly created Virtual Network, either relax the Policy for the resource group or ensure that the Template Managed Identity has permissions to join the plan.
 
+> [!IMPORTANT]
+> Make sure you follow all [best practices](image-builder-best-practices.md) while using Azure VM Image Builder.
+
 ## Next steps
 
 - [Azure VM Image Builder overview](./image-builder-overview.md)