> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure Disk Encryption For Boot Disk Volumes ### More Info: Ensure that your Microsoft Azure virtual machine (VM) boot volumes are encrypted using Azure Disk Encryption in order to meet security and compliance requirements. ADE encrypts the OS and data disks of Azure virtual machines (VMs) inside your VMs using the CPU via the DM-Crypt feature for Linux or the BitLocker feature for Windows. ADE is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets. The boot (OS) volumes encryption and decryption is handled transparently and does not require any additional action from you, your Azure virtual machine, or your cloud application. ### Risk Level Medium ### Address Security ### Compliance Standards * GDPR * HIPAA * HITRUST CSF * ISO 27001 * NIST CSF * PCI * SOC2 * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework ### Triage and Remediation ### Remediation Sure, here are the steps to remediate the Azure Disk Encryption misconfiguration for boot disk volumes using the Azure console: 1. Open the Azure portal and navigate to the virtual machine that you want to remediate. 2. Click on the "Disks" option in the left-hand menu. 3. Select the OS disk that you want to encrypt and click on "Disk encryption" in the top menu. 4. Click on the "Enable" button to enable disk encryption. 5. In the "Encryption settings" section, select "Azure managed key" and click on "Select existing" to select the key vault where the encryption key is stored. 6. Select the key that you want to use for disk encryption and click on "Select". 7. Review the encryption settings and click on "Enable encryption" to start the encryption process. 8. Wait for the encryption process to complete. This may take some time depending on the size of the disk. 9. Once the encryption process is complete, restart the virtual machine to ensure that the encryption is applied to the boot disk. That's it! You have successfully remediated the Azure Disk Encryption misconfiguration for boot disk volumes using the Azure console. # Here are the step by step instructions to remediate Azure Disk Encryption for Boot Disk Volumes using Azure CLI: 1. Check if the Azure Disk Encryption is enabled for the Boot Disk Volume of the Virtual Machine using the following command: ``` az vm encryption show --name --resource-group --query "disksEncryptionSettings[?osDisk=true].enabled" ``` If the output is `true`, then Azure Disk Encryption is enabled for the Boot Disk Volume. 2. Disable the Azure Disk Encryption for the Boot Disk Volume of the Virtual Machine using the following command: ``` az vm encryption disable --name --resource-group --volume-type OS ``` This command will disable the Azure Disk Encryption for the Boot Disk Volume of the Virtual Machine. 3. Verify if the Azure Disk Encryption is disabled for the Boot Disk Volume of the Virtual Machine using the following command: ``` az vm encryption show --name --resource-group --query "disksEncryptionSettings[?osDisk=true].enabled" ``` If the output is `false`, then Azure Disk Encryption is disabled for the Boot Disk Volume. 4. Restart the Virtual Machine to complete the remediation process. ``` az vm restart --name --resource-group ``` This command will restart the Virtual Machine to complete the remediation process. By following the above steps, you can remediate Azure Disk Encryption for Boot Disk Volumes using Azure CLI. To remediate the misconfiguration "Azure Disk Encryption For Boot Disk Volumes", you can use the following steps: 1. Install the Azure PowerShell module using the following command: ``` Install-Module -Name Az -AllowClobber -Scope CurrentUser ``` 2. Connect to your Azure account using the following command: ``` Connect-AzAccount ``` 3. Retrieve the virtual machine that needs to be remediated using the following command: ``` $vm = Get-AzVM -ResourceGroupName -Name ``` 4. Check if the boot disk is already encrypted using the following command: ``` $diskEncryptionStatus = Get-AzVMDiskEncryptionStatus -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name $bootDiskStatus = $diskEncryptionStatus[0].DiskEncryptionKeyEncryptionMethod ``` 5. If the boot disk is not encrypted, enable encryption for the boot disk using the following command: ``` $diskEncryptionKeyVaultUrl = "https://.vault.azure.net/" $diskEncryptionKeyVaultResourceId = (Get-AzKeyVault -VaultName ).ResourceId $diskEncryptionKeyEncryptionAlgorithm = "RSA-OAEP" $diskEncryptionKey = (Get-AzKeyVaultKey -VaultName -Name ).Key Set-AzVMDiskEncryptionExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $diskEncryptionKeyVaultResourceId -DiskEncryptionKeyEncryptionAlgorithm $diskEncryptionKeyEncryptionAlgorithm -DiskEncryptionKey $diskEncryptionKey -VolumeType "OS" ``` Note: Replace ``, ``, ``, and `` with the appropriate values. 6. Verify that the boot disk is encrypted using the following command: ``` $diskEncryptionStatus = Get-AzVMDiskEncryptionStatus -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name $bootDiskStatus = $diskEncryptionStatus[0].DiskEncryptionKeyEncryptionMethod ``` 7. Once you have verified that the boot disk is encrypted, you can disconnect from your Azure account using the following command: ``` Disconnect-AzAccount ``` This will remediate the misconfiguration "Azure Disk Encryption For Boot Disk Volumes" for your Azure virtual machine using Python. ```hcl theme={null} # Existing VM that needs Azure Disk Encryption enabled resource "azurerm_windows_virtual_machine" "VM_NAME" { name = "VM_NAME" resource_group_name = azurerm_resource_group.RG_NAME.name location = azurerm_resource_group.RG_NAME.location size = "VM_SIZE" network_interface_ids = [ azurerm_network_interface.NIC_NAME.id, ] admin_username = "ADMIN_USERNAME" admin_password = "ADMIN_PASSWORD" # ADE requires a managed identity on the VM identity { type = "SystemAssigned" } os_disk { caching = "ReadWrite" storage_account_type = "Premium_LRS" } # ...other VM settings... } # Key Vault holding the disk encryption key (ADE requires this) resource "azurerm_key_vault" "KV_NAME" { name = "KV_NAME" resource_group_name = azurerm_resource_group.RG_NAME.name location = azurerm_resource_group.RG_NAME.location tenant_id = data.azurerm_client_config.current.tenant_id sku_name = "standard" soft_delete_enabled = true purge_protection_enabled = true access_policy { tenant_id = data.azurerm_client_config.current.tenant_id object_id = azurerm_windows_virtual_machine.VM_NAME.identity[0].principal_id key_permissions = [ "get", "unwrapKey", "wrapKey", ] secret_permissions = [ "get", "set", ] } } # ADE requires a key in the Key Vault resource "azurerm_key_vault_key" "ADE_KEY_NAME" { name = "ADE_KEY_NAME" key_vault_id = azurerm_key_vault.KV_NAME.id key_type = "RSA" key_size = 2048 key_opts = [ "unwrapKey", "wrapKey", ] } # Azure Disk Encryption extension to encrypt the OS (boot) disk resource "azurerm_virtual_machine_extension" "ade" { name = "AzureDiskEncryption" virtual_machine_id = azurerm_windows_virtual_machine.VM_NAME.id publisher = "Microsoft.Azure.Security" type = "AzureDiskEncryption" type_handler_version = "2.2" auto_upgrade_minor_version = true settings = jsonencode({ "EncryptionOperation" = "EnableEncryption" "KeyEncryptionAlgorithm" = "RSA-OAEP" "VolumeType" = "All" # encrypt OS (boot) and data disks "KeyVaultURL" = azurerm_key_vault.KV_NAME.vault_uri "KeyVaultResourceId" = azurerm_key_vault.KV_NAME.id "KeyEncryptionKeyURL" = azurerm_key_vault_key.ADE_KEY_NAME.key_uri }) protected_settings = jsonencode({}) } ``` Substitute: * `VM_NAME`, `RG_NAME`, `NIC_NAME`, `VM_SIZE`, `ADMIN_USERNAME`, `ADMIN_PASSWORD`, `KV_NAME`, `ADE_KEY_NAME` with your actual names/values. Enabling Azure Disk Encryption via this extension will reboot the VM but does not force replacement of the VM resource itself; plan for downtime during initial encryption. To verify, `terraform plan` should show: * `azurerm_windows_virtual_machine.VM_NAME` either unchanged or updated only to add `identity`. * `azurerm_key_vault.KV_NAME` and `azurerm_key_vault_key.ADE_KEY_NAME` to be created (if new). * `azurerm_virtual_machine_extension.ade` to be created with `publisher = "Microsoft.Azure.Security"` and `type = "AzureDiskEncryption"`.