Security Hardening Guide on Aria Automation

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article provides justification for why third-party security software cannot be installed directly on these appliances.

Symptoms

• Attempts to install security consoles such as CrowdStrike (CS), TGIM, Active Directory (AD), ServiceNow (Snow), or Prisma fail or are blocked.
• Security scanners report missing agents or requirement for OS-level hardening.

Environment

• VMware Aria Automation 8.18.x
• VMware vRealize Orchestrator 8.18.x

Cause

The Aria Automation appliance is a pre-hardened, containerized solution built on Photon OS. Its design prevents manual OS-level modifications to ensure system integrity and supportability.

Resolution

Installing standalone or custom third-party software directly onto the underlying Photon OS of a production VMware Aria Automation or vRealize Orchestrator appliance is unsupported.

Review the following architectural constraints:

1. Aria Automation appliances do not require manual security hardening as they are pre-hardened at the factory.
2. Services run in pods within a containerized design that does not allow custom changes directly on the appliance operating system.
3. Docker images for the containers are pre-packaged and cannot be altered.
4. Modifying the appliance can impact system stability, interfere with future upgrades, and compromise supportability.

Use supported integration methods for security and management:

• Cloud templates
• Extensibility actions (ABX/vRO)
• Sidecar containers

If a security scanner reports a specific vulnerability, contact Broadcom support with the scan report for analysis.

Subscribe to this article to receive updates on security guidance: How to Subscribe to KBs