Alibaba CloudOverview
Description
Ensure that disks are encrypted when they are created with the creation of VM instance.
Rationale
ECS cloud disk encryption protects your data at rest. The cloud disk data encryption feature automatically encrypts data when it is transferred from ECS instances to disks, and decrypts data when it is read from disks.
References
Additional Information
You cannot directly convert unencrypted disks to encrypted disks. You can encrypt system disks only when you are copying the custom images. You can encrypt the data disk by manually creating an encrypted data disk and then copy the data from the unencrypted disk to the new encrypted disk.
Remediation guidance
Via the management console
Encrypt a system disk when copying an image in the ECS console by following the below steps:
- Login to the
ECS Console - Under
Instances & Images, selectInstances - Click
Create Instance - Under
Instances & images, underImage, selectCustom Images - Select the target image and click copy
Imagein the Actions column - In the
Copy Imagedialog box, check theEncryptbox and then select a key from the drop-down list - Click
OK
You can encrypt a data disk when creating an instance by following the below steps:
- Login to the
ECS Console - Under
Instances & Images, selectInstances - Click
Create Instance - Under
Storage,System Diskspecify the disk category and its capacity and performance - Select
Encryptionand then choose a key from the drop-down list
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Alibaba Cloud
Use Resource Directory guardrails, account baselines, and IaC modules so the secure setting is applied consistently across environments.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
'Virtual Machine's disk' are encrypted
Connectors
Covered asset types
Expected check: eq []
vms(where:{diskAttachments_SOME:{disk: {encrypted:false}}}) {...AssetFragment}
