Alibaba CloudOverview
Description
Ensure that disks are encrypted when they are created with the creation of VM instance.
Rationale
ECS cloud disk encryption protects your data at rest. The cloud disk data encryption feature automatically encrypts data when it is transferred from ECS instances to disks, and decrypts data when it is read from disks.
References
Additional Information
You cannot directly convert unencrypted disks to encrypted disks. You can encrypt system disks only when you are copying the custom images. You can encrypt the data disk by manually creating an encrypted data disk and then copy the data from the unencrypted disk to the new encrypted disk.
Remediation guidance
Via the management console
Encrypt a system disk when copying an image in the ECS console by following the below steps:
- Login to the
ECS Console - Under
Instances & Images, selectInstances - Click
Create Instance - Under
Instances & images, underImage, selectCustom Images - Select the target image and click copy
Imagein the Actions column - In the
Copy Imagedialog box, check theEncryptbox and then select a key from the drop-down list - Click
OK
You can encrypt a data disk when creating an instance by following the below steps:
- Login to the
ECS Console - Under
Instances & Images, selectInstances - Click
Create Instance - Under
Storage,System Diskspecify the disk category and its capacity and performance - Select
Encryptionand then choose a key from the drop-down list
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
'Virtual Machine's disk' are encrypted
Connectors
Covered asset types
Expected check: eq []
vms(where:{diskAttachments_SOME:{disk: {encrypted:false}}}) {...AssetFragment}
