Microsoft AzureOverview
Migrate BLOB based VHDs to Managed Disks on Virtual Machines to exploit the default features of this configuration. The features include:
- Default Disk Encryption
- Resilience, as Microsoft will manage the disk storage and move around if underlying hardware goes faulty
- Reduction of costs over storage accounts
Rationale
Managed disks are by default encrypted on the underlying hardware, so no additional encryption is required for basic protection. It is available if additional encryption is required. Managed disks are by design more resilient than storage accounts. For ARM-deployed Virtual Machines, Azure Adviser will at some point recommend moving VHDs to managed disks both from a security and cost management perspective.
Impact
There are additional costs for managed disks based off of disk space allocated. When converting to managed disks, VMs will be powered off and back on.
Remediation guidance
From Azure Console
- Using the search feature, go to
Virtual Machines - Select the virtual machine you would like to convert
- Select
Disksin the menu for the VM - At the top select
Migrate to managed disks - You may follow the prompts to convert the disk and finish by selecting `Migrate' to start the process
NOTE VMs will be stopped and restarted after migration is complete.
Using Powershell
Stop-AzVM -ResourceGroupName $rgName -Name $vmName -ForceConvertTo-AzVMManagedDisk -ResourceGroupName $rgName -VMName $vmNameStart-AzVM -ResourceGroupName $rgName -Name $vmName
References:
- https://learn.microsoft.com/en-us/azure/virtual-machines/windows/convert-unmanaged-to-managed-disks
- https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-4-enable-data-at-rest-encryption-by-default
- https://learn.microsoft.com/en-us/azure/virtual-machines/faq-for-disks
- https://azure.microsoft.com/en-us/pricing/details/managed-disks/
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Azure
Use management group or subscription Azure Policy assignments, remediation tasks where supported, landing-zone standards, and IaC modules so drift is prevented at scale.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Azure VMs with unmanaged disks
Connectors
Covered asset types
Expected check: eq []
{
vms(where: { diskAttachments_SOME: { NOT: { vhdURI: "" } } }) {
...AssetFragment
}
}
