A basic Azure Shared Image Gallery template for Ubuntu Pro 18.04 with simple CIS hardening for use as part of a tutorial

BasicCISUbuntuPro1804SIGTemplate.json

{
    "type": "Microsoft.VirtualMachineImages",
    "apiVersion": "2020-02-14",
    "location": "<region1>",
    "dependsOn": [],
    "tags": {
        "imagebuilderTemplate": "AzureImageBuilderSIG",
        "userIdentity": "enabled"
            },
        "identity": {
            "type": "UserAssigned",
                    "userAssignedIdentities": {
                    "<imgBuilderId>": {}
                        
                }
                },
    
    "properties": {

        "buildTimeoutInMinutes" : 80,

        "vmProfile": 
            {
            "vmSize": "Standard_D1_v2",
            "osDiskSizeGB": 30
            },
        
        "source": {
            "type": "PlatformImage",
                "publisher": "<ProPlanPublisher>",
                "offer": "<ProPlanOffer>",
                "sku": "<ProPlanSku>",
                "version": "latest",
        "planInfo": {
                    "planName": "<ProPlanSku>",
                    "planProduct": "<ProPlanOffer>",
                    "planPublisher": "<ProPlanPublisher>"
                }
        },
        "customize": [
            {
            "type": "Shell",
            "name": "WaitForUAtokenAutoAttach",
            "inline": [
                "sudo ua status --wait"
            ]
        },

        {
            "type": "Shell",
            "name": "EnableCISfeature",
            "inline": [
            	"sudo ua enable cis"
            ]
        },

        {
            "type": "Shell",
            "name": "RunCIShardening - see https://ubuntu.com/security/certifications/docs/cis-compliance",
            "inline": [
                "sudo /usr/share/ubuntu-scap-security-guides/cis-hardening/Canonical_Ubuntu_18.04_CIS-harden.sh lvl1_server"
            ]
        },

        {
            "type": "Shell",
            "name": "UDFworkaroundForAzureVMbooting - UDF is required for Azure image provisioning",
            "inline": [
                "sudo rm -f /etc/modprobe.d/Canonical_Ubuntu_CIS_rule-1.1.1.7.conf"
            ]
        },

        {
            "type": "Shell",
            "name": "Placeholder for custom commands required in each Ubuntu VM",
            "inline": [
                "echo 'Replace me!'"
            ]
        },

	    {
            "type": "Shell",
            "name": "DetachUA -- images created from this will auto attach themselves with new credentials",
            "inline": [
                "sudo ua detach --assume-yes && sudo rm -rf /var/log/ubuntu-advantage.log"
            ]
     	},

        {
            "type": "Shell",
            "name": "Replace /etc/machine-id with empty file to ensure UA client does not see clones as duplicates",
            "inline": [
                "sudo rm -f /etc/machine-id && sudo touch /etc/machine-id"
            ]
        }
        ],
        "distribute": 
        [
            {   
                "type": "SharedImage",
                "galleryImageId": "/subscriptions/<subscriptionID>/resourceGroups/<rgName>/providers/Microsoft.Compute/galleries/<sharedImageGalName>/images/<imageDefName>",
                "runOutputName": "<runOutputName>",
                "artifactTags": {
                    "source": "azureVmImageBuilder",
                    "baseosimg": "ubuntupro1804"
                },
                "replicationRegions": [
                  "<region1>",
                  "<region2>"
                ]
            }
        ]
    }
}