cis-azure-compute-15-6

name	cis-azure-compute-15.6
description	Ensure private DNS zones for private endpoints that connect to Batch accounts are configured
category	cis-azure-compute
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","batch"]
cis_id	15.6
cis_benchmark	CIS Microsoft Azure Compute Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure private DNS zones for private endpoints that connect to Batch accounts are configured

Description

Private DNS zones for Azure Batch private endpoints provide secure internal name resolution, preventing public internet exposure. When a private endpoint is created for a Batch account, Azure requires a private DNS zone (privatelink..batch.azure.com) to map the Batch service's domain name to a private IP address within your virtual network (VNet).

Rationale

To enable secure and private access to Azure Batch accounts, private DNS zones must be properly configured for private endpoints so as not to expose them publicly and allow for internal name resolution. Proper configuration of DNS provides assurance that DNS resolves to private IPs, reducing data exposure risk and support for security policy adherence. In the absence of proper DNS configuration, Batch services are open to connectivity failure, job interruption, or misconfigured public internet routing. Well-meshed private DNS zones hold traffic within the virtual network as intended, as a Zero Trust architecture and regulatory standard would dictate. Organizations need to audit and automate the configurations for secure and stable Batch processing.

Impact

NOTE: This recommendation assumes that a Private DNS Zone already exists. If one has not yet been created for Batch accounts [e.g. privatelink.batch.azure.com], that must be completed before it can be assigned to a Batch account's Private Endpoint.

Network architecture must be carefully considered when deploying Private DNS Zones. DNS Zones should be used to associate like services. Private DNS zones should not be used to resolve public endpoints.

Audit Procedure

Using Azure Portal

1. Login to Azure portal https://portal.azure.com
2. Navigate to Batch accounts in the Azure portal

For each batch account perform the following:

1. Expand Settings then click on Networking
2. Click the Private access tab

If no Private endpoints exist, the configuration fails this audit procedure.

For each Private endpoint perform the following:

1. Click the name of the Private Endpoint
2. Expand Settings then click on DNS Configuration
3. Scroll to the bottom where a table of Configuration entries is found

Ensure that there is an entry populated in the Private DNS Zone column (e.g. privatelink.batch.azure.com).

Expected Result