Compute disk encryption boot disk remediation

Using Console

Sure, here are the steps to remediate the Azure Disk Encryption misconfiguration for boot disk volumes using the Azure console:

Open the Azure portal and navigate to the virtual machine that you want to remediate.
Click on the “Disks” option in the left-hand menu.
Select the OS disk that you want to encrypt and click on “Disk encryption” in the top menu.
Click on the “Enable” button to enable disk encryption.
In the “Encryption settings” section, select “Azure managed key” and click on “Select existing” to select the key vault where the encryption key is stored.
Select the key that you want to use for disk encryption and click on “Select”.
Review the encryption settings and click on “Enable encryption” to start the encryption process.
Wait for the encryption process to complete. This may take some time depending on the size of the disk.
Once the encryption process is complete, restart the virtual machine to ensure that the encryption is applied to the boot disk.

That’s it! You have successfully remediated the Azure Disk Encryption misconfiguration for boot disk volumes using the Azure console.

Using CLI

Here are the step by step instructions to remediate Azure Disk Encryption for Boot Disk Volumes using Azure CLI:

Check if the Azure Disk Encryption is enabled for the Boot Disk Volume of the Virtual Machine using the following command:
az vm encryption show --name <VM Name> --resource-group <Resource Group Name> --query "disksEncryptionSettings[?osDisk=true].enabled"
If the output is true, then Azure Disk Encryption is enabled for the Boot Disk Volume.
Disable the Azure Disk Encryption for the Boot Disk Volume of the Virtual Machine using the following command:
az vm encryption disable --name <VM Name> --resource-group <Resource Group Name> --volume-type OS
This command will disable the Azure Disk Encryption for the Boot Disk Volume of the Virtual Machine.
Verify if the Azure Disk Encryption is disabled for the Boot Disk Volume of the Virtual Machine using the following command:
az vm encryption show --name <VM Name> --resource-group <Resource Group Name> --query "disksEncryptionSettings[?osDisk=true].enabled"
If the output is false, then Azure Disk Encryption is disabled for the Boot Disk Volume.
Restart the Virtual Machine to complete the remediation process.
az vm restart --name <VM Name> --resource-group <Resource Group Name>
This command will restart the Virtual Machine to complete the remediation process.

By following the above steps, you can remediate Azure Disk Encryption for Boot Disk Volumes using Azure CLI.

Using Python

To remediate the misconfiguration “Azure Disk Encryption For Boot Disk Volumes”, you can use the following steps:

Install the Azure PowerShell module using the following command:

Install-Module -Name Az -AllowClobber -Scope CurrentUser

Connect to your Azure account using the following command:

Connect-AzAccount

Retrieve the virtual machine that needs to be remediated using the following command:

$vm = Get-AzVM -ResourceGroupName <resource-group-name> -Name <vm-name>

Check if the boot disk is already encrypted using the following command:

$diskEncryptionStatus = Get-AzVMDiskEncryptionStatus -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name
$bootDiskStatus = $diskEncryptionStatus[0].DiskEncryptionKeyEncryptionMethod

If the boot disk is not encrypted, enable encryption for the boot disk using the following command:

$diskEncryptionKeyVaultUrl = "https://<key-vault-name>.vault.azure.net/"
$diskEncryptionKeyVaultResourceId = (Get-AzKeyVault -VaultName <key-vault-name>).ResourceId
$diskEncryptionKeyEncryptionAlgorithm = "RSA-OAEP"
$diskEncryptionKey = (Get-AzKeyVaultKey -VaultName <key-vault-name> -Name <key-name>).Key
Set-AzVMDiskEncryptionExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $diskEncryptionKeyVaultResourceId -DiskEncryptionKeyEncryptionAlgorithm $diskEncryptionKeyEncryptionAlgorithm -DiskEncryptionKey $diskEncryptionKey -VolumeType "OS"

Note: Replace <resource-group-name>, <vm-name>, <key-vault-name>, and <key-name> with the appropriate values.

Verify that the boot disk is encrypted using the following command:

$diskEncryptionStatus = Get-AzVMDiskEncryptionStatus -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name
$bootDiskStatus = $diskEncryptionStatus[0].DiskEncryptionKeyEncryptionMethod

Once you have verified that the boot disk is encrypted, you can disconnect from your Azure account using the following command:

Disconnect-AzAccount

This will remediate the misconfiguration “Azure Disk Encryption For Boot Disk Volumes” for your Azure virtual machine using Python.

Using Terraform

# Existing VM that needs Azure Disk Encryption enabled
resource "azurerm_windows_virtual_machine" "VM_NAME" {
  name                = "VM_NAME"
  resource_group_name = azurerm_resource_group.RG_NAME.name
  location            = azurerm_resource_group.RG_NAME.location
  size                = "VM_SIZE"

  network_interface_ids = [
    azurerm_network_interface.NIC_NAME.id,
  ]

  admin_username = "ADMIN_USERNAME"
  admin_password = "ADMIN_PASSWORD"

  # ADE requires a managed identity on the VM
  identity {
    type = "SystemAssigned"
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
  }

  # ...other VM settings...
}

# Key Vault holding the disk encryption key (ADE requires this)
resource "azurerm_key_vault" "KV_NAME" {
  name                        = "KV_NAME"
  resource_group_name         = azurerm_resource_group.RG_NAME.name
  location                    = azurerm_resource_group.RG_NAME.location
  tenant_id                   = data.azurerm_client_config.current.tenant_id
  sku_name                    = "standard"
  soft_delete_enabled         = true
  purge_protection_enabled    = true

  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = azurerm_windows_virtual_machine.VM_NAME.identity[0].principal_id

    key_permissions = [
      "get",
      "unwrapKey",
      "wrapKey",
    ]

    secret_permissions = [
      "get",
      "set",
    ]
  }
}

# ADE requires a key in the Key Vault
resource "azurerm_key_vault_key" "ADE_KEY_NAME" {
  name         = "ADE_KEY_NAME"
  key_vault_id = azurerm_key_vault.KV_NAME.id
  key_type     = "RSA"
  key_size     = 2048

  key_opts = [
    "unwrapKey",
    "wrapKey",
  ]
}

# Azure Disk Encryption extension to encrypt the OS (boot) disk
resource "azurerm_virtual_machine_extension" "ade" {
  name                 = "AzureDiskEncryption"
  virtual_machine_id   = azurerm_windows_virtual_machine.VM_NAME.id
  publisher            = "Microsoft.Azure.Security"
  type                 = "AzureDiskEncryption"
  type_handler_version = "2.2"
  auto_upgrade_minor_version = true

  settings = jsonencode({
    "EncryptionOperation"         = "EnableEncryption"
    "KeyEncryptionAlgorithm"      = "RSA-OAEP"
    "VolumeType"                  = "All" # encrypt OS (boot) and data disks
    "KeyVaultURL"                 = azurerm_key_vault.KV_NAME.vault_uri
    "KeyVaultResourceId"          = azurerm_key_vault.KV_NAME.id
    "KeyEncryptionKeyURL"         = azurerm_key_vault_key.ADE_KEY_NAME.key_uri
  })

  protected_settings = jsonencode({})
}

Substitute:

VM_NAME, RG_NAME, NIC_NAME, VM_SIZE, ADMIN_USERNAME, ADMIN_PASSWORD, KV_NAME, ADE_KEY_NAME with your actual names/values.

Enabling Azure Disk Encryption via this extension will reboot the VM but does not force replacement of the VM resource itself; plan for downtime during initial encryption.To verify, terraform plan should show:

azurerm_windows_virtual_machine.VM_NAME either unchanged or updated only to add identity.
azurerm_key_vault.KV_NAME and azurerm_key_vault_key.ADE_KEY_NAME to be created (if new).
azurerm_virtual_machine_extension.ade to be created with publisher = "Microsoft.Azure.Security" and type = "AzureDiskEncryption".

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Compute disk encryption boot disk remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation