Documenting best practices for Azure VM Image Builder

Author: sumit-kalra

articles/virtual-machines/TOC.yml

@@ -742,6 +742,9 @@
       - name: Troubleshoot
         displayName: Image builder, images, building
         href: ./linux/image-builder-troubleshoot.md
+      - name: Best practices
+        displayName: Image builder, images, building, best practices
+        href: image-builder-best-practices.md
       - name: Image Builder Reliability
         displayName: Image builder, images, building, reliability, resiliency, recovery
         href: ../reliability/reliability-image-builder.md?toc=/azure/virtual-machines/toc.json&bc=/azure/virtual-machines/breadcrumb/toc.json

articles/virtual-machines/image-builder-best-practices.md

@@ -0,0 +1,27 @@
+---
+title: Best Practices
+description: This article describes best practices to be followed while using Azure VM Image Builder.
+author: sumit-kalra
+ms.service: virtual-machines
+ms.topic: conceptual
+ms.date: 03/25/2024
+ms.reviewer: mattmcinnes
+ms.subservice: image-builder
+ms.custom: references_regions
+---
+
+# Best Practices
+
+**Applies to:** :heavy_check_mark: Linux VMs :heavy_check_mark: Windows VMs :heavy_check_mark: Flexible scale sets :heavy_check_mark: Uniform scale sets
+
+This article describes best practices to be followed while using Azure VM Image Builder (AIB).
+
+- To prevent image templates from being accidentally deleted, use resource locks at the image template resource level. For more information, see [Protect your Azure resources with a lock](../azure-resource-manager/management/lock-resources.md).
+- Make sure your image tempaltes are setup for disaster recovery by following [reliability recommendation for AIB](../reliability/reliability-image-builder.md?toc=/azure/virtual-machines/toc.json&bc=/azure/virtual-machines/breadcrumb/toc.json).
+- Set up AIB [triggers](image-builder-triggers-how-to.md) to automatically rebuild your images and keep them updated.
+- Enable [VM Boot Optimization](vm-boot-optimization.md) in AIB to improve the create time for your VMs.
+- Follow the [principle of least privilege](https://learn.microsoft.com/en-us/entra/identity-platform/secure-least-privileged-access) for your AIB resources:
+  - **Image Template**: A prinicpal that has access to your image template will be able to run, delete, or tamper with it. This, in turn, will allow the principal to change the images created by that image template.
+  - **Staging Resource Group**: AIB uses a staging resource group in your subscription to customize your VM image. You must consider this resource group as sensitive and restrict access to this resource group only to required principals. Since the process of customizing your image takes place in this resource group, a principal with access to the resource group will be able to compromise the image building process - for example, by injecting malware into the image. AIB also delegates priveleges associated with the Template identity and Build VM identity to resources in this resource group. Hence, a principal with access to the resource group will be able to get access to these identities. Further, AIB maintains a copy of your customizer artifacts in this resource group. Hence, a principal with access to the resource group will be able to inspect these copies.
+  - **Template Identity**: A principal with access to your template identity will be able to access all resources that the identity has permissions for including your customizer artifacts (for example, shell and PowerShell scripts), your distribution targets (for example, an Azure Compute Gallery image version), and your Virtual Network. Hence, you must provided only the minimum required priveleges to this identity.
+  - **Build VM Identity**: A principal with access to your build VM identity will be able to access all resources that the identity has permissions for including any artifacts and Virtual Network that you may be using from within the Build VM using this identity. Hence, you must provided only the minimum required priveleges to this identity.

articles/virtual-machines/security-isolated-image-builds-image-builder.md

@@ -51,6 +51,9 @@ Your image builds will automatically be migrated to Isolated Image Builds and yo
 >
 > If you have Azure Policies applying DDoS protection plans to any newly created Virtual Network, either relax the Policy for the resource group or ensure that the Template Managed Identity has permissions to join the plan.
 
+> [!IMPORTANT]
+> Make sure you follow all [best practices](image-builder-best-practices.md) while using Azure VM Image Builder.
+
 ## Next steps
 
 - [Azure VM Image Builder overview](./image-builder-overview.md)