Cmk Virtual Hard Disk Encryption Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for Azure using the Azure console, follow the below steps:

Open the Azure portal and log in to your account.
Navigate to the virtual machine that you want to remediate.
Select the virtual machine and click on the "Disks" option in the left-hand side menu.
Select the disk that you want to encrypt with customer-managed keys.
Click on the "Disk Encryption" option in the top menu.
In the Disk Encryption pane, select "Customer Managed Keys" as the encryption type.
Click on the "Select a Key" option and choose the key that you want to use for encryption.
Click on the "Save" button to save the changes.
Wait for the encryption process to complete.

Once the encryption process is complete, the virtual machine disk will be encrypted with the customer-managed key.

Using CLI

To remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for Azure using Azure CLI, follow the below steps:

Open Azure CLI and log in to your Azure account.
Create a new customer-managed key in Azure Key Vault using the below command:

az keyvault key create --vault-name <key-vault-name> --name <key-name> --protection software

Replace <key-vault-name> with the name of your Azure Key Vault and <key-name> with a name for your new key.
Retrieve the key ID of the newly created key using the below command:

az keyvault key show --vault-name <key-vault-name> --name <key-name> --query key.kid -o tsv

This command will return the key ID in the format:

/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<key-vault-name>/keys/<key-name>/<key-version>
Update the virtual hard disk (VHD) to use the customer-managed key for encryption using the below command:

az disk encryption set --resource-group <resource-group-name> --name <disk-name> --key-url <key-id> --key-vault <key-vault-name> --encryption-type <encryption-type>

Replace <resource-group-name> with the name of the resource group containing the VHD, <disk-name> with the name of the VHD to be encrypted, <key-id> with the key ID retrieved in step 3, <key-vault-name> with the name of the Azure Key Vault, and <encryption-type> with the type of encryption to use (e.g. "AES256").
Verify that the disk encryption is enabled by running the below command:

az disk encryption show --resource-group <resource-group-name> --name <disk-name>

This command will return the encryption status of the disk.

By following the above steps, you can remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for Azure using Azure CLI.

Using Python

To remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for AZURE using Python, you can follow the below steps:

Step 1: Import the required libraries and authenticate to Azure

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.resource import ResourceManagementClient

credential = DefaultAzureCredential()
compute_client = ComputeManagementClient(
    credential=credential,
    subscription_id='<subscription-id>'
)
resource_client = ResourceManagementClient(
    credential=credential,
    subscription_id='<subscription-id>'
)

Step 2: Get the list of virtual machines in the subscription

vm_list = compute_client.virtual_machines.list_all()

Step 3: For each virtual machine, check if the virtual hard disk is encrypted with a customer managed key. If not, update the encryption settings to use a customer managed key.

for vm in vm_list:
    for disk in vm.storage_profile.data_disks:
        if not disk.disk_encryption_settings or not disk.disk_encryption_settings.enabled:
            # Update the encryption settings to use customer managed key
            disk.disk_encryption_settings = {
                'enabled': True,
                'disk_encryption_key': {
                    'source': 'Microsoft.Keyvault',
                    'vault_uri': '<key-vault-uri>',
                    'secret_url': '<key-secret-url>'
                }
            }
            compute_client.virtual_machines.create_or_update(
                resource_group_name=vm.id.split('/')[4],
                vm_name=vm.name,
                parameters=vm
            )

Note: Replace the <subscription-id>, <key-vault-uri> and <key-secret-url> placeholders with the actual values.

By following the above steps, you can remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for AZURE using Python.

Using Terraform

# Customer-managed key in Key Vault
resource "azurerm_key_vault" "cmk_kv" {
  name                       = "KV_NAME"                    # substitute your Key Vault name
  resource_group_name        = "RESOURCE_GROUP_NAME"        # substitute your RG
  location                   = "LOCATION"                   # substitute your region
  tenant_id                  = "TENANT_ID"                  # substitute your tenant ID
  sku_name                   = "standard"

  soft_delete_retention_days = 7
  purge_protection_enabled   = true

  access_policy {
    tenant_id = "TENANT_ID"                                # same as above
    object_id = "ADMIN_OBJECT_ID"                          # principal allowed to manage keys

    key_permissions = [
      "Create",
      "Get",
      "List",
      "Update",
      "GetRotationPolicy",
    ]
  }
}

resource "azurerm_key_vault_key" "cmk" {
  name         = "CMK_KEY_NAME"                            # substitute key name
  key_vault_id = azurerm_key_vault.cmk_kv.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "decrypt",
    "encrypt",
    "wrapKey",
    "unwrapKey",
  ]
}

# Disk Encryption Set using the CMK
resource "azurerm_user_assigned_identity" "disk_identity" {
  name                = "DISK_IDENTITY_NAME"               # substitute identity name
  resource_group_name = "RESOURCE_GROUP_NAME"
  location            = "LOCATION"
}

resource "azurerm_role_assignment" "kv_disk_crypto" {
  scope                = azurerm_key_vault.cmk_kv.id
  role_definition_name = "Key Vault Crypto Service Encryption User"
  principal_id         = azurerm_user_assigned_identity.disk_identity.principal_id
}

resource "azurerm_disk_encryption_set" "cmk_des" {
  name                = "DISK_ENCRYPTION_SET_NAME"         # substitute DES name
  resource_group_name = "RESOURCE_GROUP_NAME"
  location            = "LOCATION"
  key_vault_key_id    = azurerm_key_vault_key.cmk.id

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.disk_identity.id]
  }
}

# Example: use CMK for VM OS disk (managed disk)
resource "azurerm_windows_virtual_machine" "vm" {
  name                = "VM_NAME"                          # substitute VM name
  resource_group_name = "RESOURCE_GROUP_NAME"
  location            = "LOCATION"
  size                = "Standard_DS1_v2"
  admin_username      = "ADMIN_USERNAME"
  admin_password      = "ADMIN_PASSWORD"
  network_interface_ids = [
    "NIC_ID",                                              # substitute an existing NIC ID
  ]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"

    # This is the critical change: use CMK via Disk Encryption Set
    disk_encryption_set_id = azurerm_disk_encryption_set.cmk_des.id
  }

  source_image_reference {
    publisher = "MicrosoftWindowsServer"
    offer     = "WindowsServer"
    sku       = "2019-Datacenter"
    version   = "latest"
  }
}

Switching an existing VM OS or data disk from platform-managed keys to a disk_encryption_set_id forces replacement of the disk (and typically recreation of the VM), which is an outage; plan carefully before applying.

Verification: terraform plan should show creation of the Key Vault, key, user-assigned identity, role assignment, disk encryption set, and an in-place update (or replacement) on the VM resource adding disk_encryption_set_id under the os_disk (and similarly under any data_disk blocks you update).

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation