> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit compute os disks without encryption remediation ### Triage and Remediation ### Remediation Here are the steps to remediate the OS Disks Lacking Encryption misconfiguration in AZURE using the AZURE console: 1. Log in to the AZURE portal. 2. Navigate to the Virtual Machines blade. 3. Select the virtual machine that has the OS Disks Lacking Encryption misconfiguration. 4. Click on the "Disks" option under the Settings section. 5. Select the OS disk that you want to encrypt. 6. Click on the "Disk Encryption" option under the "Settings" section. 7. Click on the "Enable" button to enable the disk encryption. 8. Choose the encryption type and the encryption key. 9. Click on the "Save" button to save the changes. Once the encryption is enabled, the OS disk will be encrypted, and the misconfiguration will be remediated. It is important to note that the encryption process may take some time to complete, depending on the size of the disk. # To remediate the misconfiguration of OS Disks lacking encryption in AZURE using AZURE CLI, you can follow the below steps: 1. Open the Azure CLI on your local machine or Azure Cloud Shell. 2. Run the following command to check if the encryption is enabled on the VM: `az vm encryption show --resource-group --name ` Replace `` with the name of the resource group in which the VM is located, and `` with the name of the VM. 3. If encryption is not enabled on the VM, run the following command to enable encryption: `az vm encryption enable --resource-group --name --disk-encryption-keyvault --key-encryption-keyvault --volume-type ALL` Replace `` with the name of the resource group in which the VM is located, `` with the name of the VM, and `` with the name of the key vault where encryption keys are stored. 4. Once the command is executed successfully, the encryption process will start, and it may take some time depending on the size of the VM. 5. After the encryption process is complete, run the following command to verify that encryption is enabled: `az vm encryption show --resource-group --name ` This command will display the encryption status of the VM. 6. Finally, confirm that the OS disks are encrypted by logging into the VM and checking the disk properties. By following these steps, you can remediate the misconfiguration of OS disks lacking encryption in Azure using Azure CLI. To remediate the misconfiguration of OS Disks Lacking Encryption in AZURE using python, follow these steps: 1. Install the Azure SDK for Python using the following command: ``` pip install azure-mgmt-compute ``` 2. Import the necessary modules: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient ``` 3. Authenticate to the Azure account using the `DefaultAzureCredential` class: ```python theme={null} credential = DefaultAzureCredential() subscription_id = 'your-subscription-id' compute_client = ComputeManagementClient(credential, subscription_id) ``` 4. Get a list of all the virtual machines in the subscription: ```python theme={null} vm_list = compute_client.virtual_machines.list_all() ``` 5. For each virtual machine, check if the OS disk is encrypted or not: ```python theme={null} for vm in vm_list: os_disk = vm.storage_profile.os_disk if not os_disk.encryption_settings: # Encrypt the OS disk encryption_settings = compute_client.disks.create_or_update_encryption_settings( resource_group_name=vm.id.split('/')[4], disk_name=os_disk.name, encryption_settings={ "enabled": True } ) ``` 6. Save the script and run it to remediate the misconfiguration. Note: This script assumes that the virtual machines are using managed disks. If the virtual machines are using unmanaged disks, you will need to modify the script accordingly. ```hcl theme={null} resource "azurerm_resource_group" "RG_NAME" { name = "RG_NAME" # replace with your resource group name location = "AZURE_REGION" # e.g. "eastus" } resource "azurerm_key_vault" "OS_DISK_KV" { name = "KEY_VAULT_NAME" # must be globally unique location = azurerm_resource_group.RG_NAME.location resource_group_name = azurerm_resource_group.RG_NAME.name tenant_id = "TENANT_ID" # replace with your AAD tenant ID sku_name = "standard" purge_protection_enabled = true soft_delete_retention_days = 90 access_policy { tenant_id = "TENANT_ID" object_id = "DISK_ENCRYPTION_SET_MSI_OBJECT_ID" # will be the DES identity later key_permissions = [ "Get", "WrapKey", "UnwrapKey", ] } } resource "azurerm_key_vault_key" "OS_DISK_KEY" { name = "os-disk-cmk" key_vault_id = azurerm_key_vault.OS_DISK_KV.id key_type = "RSA" key_size = 2048 key_opts = [ "wrapKey", "unwrapKey", ] } resource "azurerm_disk_encryption_set" "OS_DISK_DES" { name = "os-disk-des" location = azurerm_resource_group.RG_NAME.location resource_group_name = azurerm_resource_group.RG_NAME.name key_vault_key_id = azurerm_key_vault_key.OS_DISK_KEY.id identity { type = "SystemAssigned" } } resource "azurerm_linux_virtual_machine" "VM_NAME" { name = "VM_NAME" # replace with your VM name location = azurerm_resource_group.RG_NAME.location resource_group_name = azurerm_resource_group.RG_NAME.name size = "Standard_DS1_v2" admin_username = "ADMIN_USERNAME" network_interface_ids = [ "NIC_RESOURCE_ID", # reference your NIC ] os_disk { name = "VM_NAME-osdisk" caching = "ReadWrite" storage_account_type = "Premium_LRS" # This is the fix: encrypt the OS disk with a Disk Encryption Set (customer-managed key) disk_encryption_set_id = azurerm_disk_encryption_set.OS_DISK_DES.id } source_image_reference { publisher = "Canonical" offer = "0001-com-ubuntu-server-focal" sku = "20_04-lts" version = "latest" } admin_ssh_key { username = "ADMIN_USERNAME" public_key = "SSH_PUBLIC_KEY" } } ``` Changing or adding `disk_encryption_set_id` on the existing OS disk forces replacement of the OS disk and VM (planned downtime and data loss on that disk), so apply only after backups or migration. For an existing standalone managed OS disk (`azurerm_managed_disk`), set `disk_encryption_set_id` similarly on that resource; this also forces disk replacement. Verification: `terraform plan` should show creation of `azurerm_disk_encryption_set.OS_DISK_DES` (and its Key Vault/key if new) and an update to the VM (or managed disk) adding `disk_encryption_set_id` on the OS disk, with a note that the disk and VM will be recreated.