Microsoft AzureOverview
Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).
Rationale
Managed disks are encrypted by default with Platform-managed keys. Using Customer-managed keys may provide an additional level of security or meet an organization's regulatory requirements. Encrypting managed disks ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks which may lead to sensitive information disclosure and tampering.
Impact
Having a key vault set up to utilize this is needed. Encryption is available only on Standard tier VMs. This might increase costs.
Utilizing and maintaining Customer-managed keys will require additional work to create, protect, and rotate keys.
Default Value
By default, managed disks are encrypted with a Platform-managed key.
References
- https://learn.microsoft.com/en-us/azure/security/fundamentals/azure-disk-encryption-vms-vmss
- https://learn.microsoft.com/en-us/azure/security-center/security-center-disk-encryption?toc=%2fazure%2fsecurity%2ftoc.json
- https://learn.microsoft.com/en-us/rest/api/compute/disks/delete
- https://learn.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-delete
- https://learn.microsoft.com/en-us/rest/api/compute/disks/update#encryptionsettings
- https://learn.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-update
- https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-5-encrypt-sensitive-data-at-rest
Remediation guidance
From Azure Console
- Go to
Disks - Click on
Add filter - For
Filter nameselectDisk state, forOperatorselectEquals, and forValueonly selectUnattached - Select
Apply - For every disk, go to
EncryptionunderSettings - For
Key management, select the customer-managed key you want to use - Select
Save
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
'Unattached disks' are encrypted with CMK
Connectors
Covered asset types
Expected check: eq []
{disks(where:{diskState_MATCHES:"(?i)unattached",encryptionKey:null}){...AssetFragment}}
