> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cmk virtual hard disk encryption remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for Azure using the Azure console, follow the below steps: 1. Open the Azure portal and log in to your account. 2. Navigate to the virtual machine that you want to remediate. 3. Select the virtual machine and click on the "Disks" option in the left-hand side menu. 4. Select the disk that you want to encrypt with customer-managed keys. 5. Click on the "Disk Encryption" option in the top menu. 6. In the Disk Encryption pane, select "Customer Managed Keys" as the encryption type. 7. Click on the "Select a Key" option and choose the key that you want to use for encryption. 8. Click on the "Save" button to save the changes. 9. Wait for the encryption process to complete. Once the encryption process is complete, the virtual machine disk will be encrypted with the customer-managed key. # To remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for Azure using Azure CLI, follow the below steps: 1. Open Azure CLI and log in to your Azure account. 2. Create a new customer-managed key in Azure Key Vault using the below command: `az keyvault key create --vault-name --name --protection software` Replace `` with the name of your Azure Key Vault and `` with a name for your new key. 3. Retrieve the key ID of the newly created key using the below command: `az keyvault key show --vault-name --name --query key.kid -o tsv` This command will return the key ID in the format: `/subscriptions//resourceGroups//providers/Microsoft.KeyVault/vaults//keys//` 4. Update the virtual hard disk (VHD) to use the customer-managed key for encryption using the below command: `az disk encryption set --resource-group --name --key-url --key-vault --encryption-type ` Replace `` with the name of the resource group containing the VHD, `` with the name of the VHD to be encrypted, `` with the key ID retrieved in step 3, `` with the name of the Azure Key Vault, and `` with the type of encryption to use (e.g. "AES256"). 5. Verify that the disk encryption is enabled by running the below command: `az disk encryption show --resource-group --name ` This command will return the encryption status of the disk. By following the above steps, you can remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for Azure using Azure CLI. To remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for AZURE using Python, you can follow the below steps: Step 1: Import the required libraries and authenticate to Azure ``` from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.resource import ResourceManagementClient credential = DefaultAzureCredential() compute_client = ComputeManagementClient( credential=credential, subscription_id='' ) resource_client = ResourceManagementClient( credential=credential, subscription_id='' ) ``` Step 2: Get the list of virtual machines in the subscription ``` vm_list = compute_client.virtual_machines.list_all() ``` Step 3: For each virtual machine, check if the virtual hard disk is encrypted with a customer managed key. If not, update the encryption settings to use a customer managed key. ``` for vm in vm_list: for disk in vm.storage_profile.data_disks: if not disk.disk_encryption_settings or not disk.disk_encryption_settings.enabled: # Update the encryption settings to use customer managed key disk.disk_encryption_settings = { 'enabled': True, 'disk_encryption_key': { 'source': 'Microsoft.Keyvault', 'vault_uri': '', 'secret_url': '' } } compute_client.virtual_machines.create_or_update( resource_group_name=vm.id.split('/')[4], vm_name=vm.name, parameters=vm ) ``` Note: Replace the ``, `` and `` placeholders with the actual values. By following the above steps, you can remediate the misconfiguration "Use Customer Managed Keys for Virtual Hard Disk Encryption" for AZURE using Python. ```hcl theme={null} # Customer-managed key in Key Vault resource "azurerm_key_vault" "cmk_kv" { name = "KV_NAME" # substitute your Key Vault name resource_group_name = "RESOURCE_GROUP_NAME" # substitute your RG location = "LOCATION" # substitute your region tenant_id = "TENANT_ID" # substitute your tenant ID sku_name = "standard" soft_delete_retention_days = 7 purge_protection_enabled = true access_policy { tenant_id = "TENANT_ID" # same as above object_id = "ADMIN_OBJECT_ID" # principal allowed to manage keys key_permissions = [ "Create", "Get", "List", "Update", "GetRotationPolicy", ] } } resource "azurerm_key_vault_key" "cmk" { name = "CMK_KEY_NAME" # substitute key name key_vault_id = azurerm_key_vault.cmk_kv.id key_type = "RSA" key_size = 2048 key_opts = [ "decrypt", "encrypt", "wrapKey", "unwrapKey", ] } # Disk Encryption Set using the CMK resource "azurerm_user_assigned_identity" "disk_identity" { name = "DISK_IDENTITY_NAME" # substitute identity name resource_group_name = "RESOURCE_GROUP_NAME" location = "LOCATION" } resource "azurerm_role_assignment" "kv_disk_crypto" { scope = azurerm_key_vault.cmk_kv.id role_definition_name = "Key Vault Crypto Service Encryption User" principal_id = azurerm_user_assigned_identity.disk_identity.principal_id } resource "azurerm_disk_encryption_set" "cmk_des" { name = "DISK_ENCRYPTION_SET_NAME" # substitute DES name resource_group_name = "RESOURCE_GROUP_NAME" location = "LOCATION" key_vault_key_id = azurerm_key_vault_key.cmk.id identity { type = "UserAssigned" identity_ids = [azurerm_user_assigned_identity.disk_identity.id] } } # Example: use CMK for VM OS disk (managed disk) resource "azurerm_windows_virtual_machine" "vm" { name = "VM_NAME" # substitute VM name resource_group_name = "RESOURCE_GROUP_NAME" location = "LOCATION" size = "Standard_DS1_v2" admin_username = "ADMIN_USERNAME" admin_password = "ADMIN_PASSWORD" network_interface_ids = [ "NIC_ID", # substitute an existing NIC ID ] os_disk { caching = "ReadWrite" storage_account_type = "Premium_LRS" # This is the critical change: use CMK via Disk Encryption Set disk_encryption_set_id = azurerm_disk_encryption_set.cmk_des.id } source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2019-Datacenter" version = "latest" } } ``` Switching an existing VM OS or data disk from platform-managed keys to a `disk_encryption_set_id` **forces replacement of the disk** (and typically recreation of the VM), which is an outage; plan carefully before applying. Verification: `terraform plan` should show creation of the Key Vault, key, user-assigned identity, role assignment, disk encryption set, and an in-place update (or replacement) on the VM resource adding `disk_encryption_set_id` under the `os_disk` (and similarly under any `data_disk` blocks you update).