> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compute disk encryption non boot disk remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the Azure Disk Encryption misconfiguration for non-boot disk using the Azure console:

        1. Open the Azure portal and navigate to the virtual machine that you want to remediate.

        2. In the virtual machine's menu, click on the "Disks" option.

        3. Identify the non-boot disk that needs to be encrypted and click on it.

        4. In the disk's menu, click on the "Disk encryption" option.

        5. In the "Disk encryption" page, click on the "Enable" button to start the encryption process.

        6. In the "Encryption settings" page, select the encryption type and the key vault that you want to use for encryption.

        7. If you don't have a key vault, you can create one by clicking on the "Create new" button and following the prompts.

        8. Once you have selected the encryption type and key vault, click on the "Review + Create" button to review the settings.

        9. In the "Review + Create" page, review the settings and click on the "Create" button to start the encryption process.

        10. The encryption process may take some time to complete depending on the size of the disk. Once the encryption process is complete, you will see a "Disk encryption is enabled" message in the disk's menu.

        That's it! You have successfully remediated the Azure Disk Encryption misconfiguration for the non-boot disk using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        Sure, here are the step-by-step instructions to remediate the Azure Disk Encryption misconfiguration for non-boot disks using Azure CLI:

        1. Open the Azure CLI and login to your Azure account using the command `az login`.

        2. Once you are logged in, check if you have the necessary permissions to perform disk encryption using the command `az disk-encryption-set list`.

        3. Next, you need to create a new encryption set using the command `az disk-encryption-set create`. You will need to specify the name of the encryption set, the resource group, and the location.

        4. After creating the encryption set, you need to enable encryption for the non-boot disk using the command `az disk update`. You will need to specify the name of the disk, the resource group, and the ID of the encryption set.

        5. Finally, you can verify that the disk encryption is enabled using the command `az disk show`. This will display the disk details, including the encryption status.

        Here is an example command to enable encryption for a non-boot disk:

        ```
        az disk update --name <disk-name> --resource-group <resource-group-name> --encryption-type "EncryptionAtRestWithPlatformKey" --disk-encryption-set <encryption-set-id>
        ```

        Note: The `encryption-type` parameter is set to "EncryptionAtRestWithPlatformKey" which means encryption will be done using the Azure platform key. You can also use "EncryptionAtRestWithCustomerKey" to use your own customer-managed key for encryption.

        I hope this helps! Let me know if you have any further questions.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the Azure Disk Encryption misconfiguration for non-boot disk using Python, you can follow these steps:

        1. Install the Azure SDK for Python and import the required modules:

        ```
        pip install azure
        pip install azure-mgmt-compute
        pip install azure-mgmt-storage
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.compute import ComputeManagementClient
        from azure.mgmt.storage import StorageManagementClient
        ```

        2. Authenticate and create a client object for the Azure Compute and Storage Management APIs:

        ```
        TENANT_ID = '<your tenant id>'
        CLIENT_ID = '<your client id>'
        CLIENT_SECRET = '<your client secret>'
        SUBSCRIPTION_ID = '<your subscription id>'

        credentials = ServicePrincipalCredentials(
            client_id=CLIENT_ID,
            secret=CLIENT_SECRET,
            tenant=TENANT_ID
        )

        compute_client = ComputeManagementClient(credentials, SUBSCRIPTION_ID)
        storage_client = StorageManagementClient(credentials, SUBSCRIPTION_ID)
        ```

        3. Get the list of all the virtual machines in the subscription:

        ```
        vm_list = compute_client.virtual_machines.list_all()
        ```

        4. For each virtual machine, check if it has any non-boot disks that are not encrypted:

        ```
        for vm in vm_list:
            for disk in vm.storage_profile.data_disks:
                disk_id = disk.managed_disk.id
                disk_resource_group = disk_id.split('/')[4]
                disk_name = disk_id.split('/')[-1]
                disk_info = storage_client.disks.get(disk_resource_group, disk_name)
                
                if not disk_info.encryption:
                    # Encrypt the disk
        ```

        5. To encrypt the non-boot disk, update the disk resource with encryption settings:

        ```
        encryption_settings = {
            'disk_encryption_key': {
                'source_vault': {
                    'id': '<your key vault id>'
                },
                'secret_url': '<your secret url>'
            },
            'key_encryption_key': {
                'source_vault': {
                    'id': '<your key vault id>'
                },
                'key_url': '<your key url>',
                'key_version': '<your key version>'
            }
        }

        disk_info.encryption = encryption_settings
        storage_client.disks.create_or_update(disk_resource_group, disk_name, disk_info)
        ```

        6. Save the script and run it to remediate the Azure Disk Encryption misconfiguration for non-boot disks.

        Note: Replace the placeholders `<your tenant id>`, `<your client id>`, `<your client secret>`, `<your subscription id>`, `<your key vault id>`, `<your secret url>`, `<your key url>`, and `<your key version>` with your actual values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_virtual_machine_extension" "DATA_DISK_ADE" {
          name                       = "enable-ade-data-disks"
          virtual_machine_id         = azurerm_virtual_machine.TARGET_VM.id # replace with your VM resource
          publisher                  = "Microsoft.Azure.Security"
          type                       = "AzureDiskEncryption"
          type_handler_version       = "2.2"
          auto_upgrade_minor_version = true

          # Replace placeholders with your actual values
          settings = jsonencode({
            "EncryptionOperation"      = "EnableEncryption"
            "KeyVaultURL"              = azurerm_key_vault.ADE_KEY_VAULT.vault_uri # or "https://YOUR_KEY_VAULT_NAME.vault.azure.net/"
            "KeyVaultResourceId"       = azurerm_key_vault.ADE_KEY_VAULT.id        # or "/subscriptions/.../resourceGroups/.../providers/Microsoft.KeyVault/vaults/..."
            "KeyEncryptionKeyURL"      = azurerm_key_vault_key.ADE_KEK.id          # KEK URL in Key Vault
            "KeyEncryptionAlgorithm"   = "RSA-OAEP"
            "VolumeType"               = "Data"                                    # only non-boot (data) disks
            "SequenceVersion"          = "1"                                       # bump this to re-run extension if needed
          })

          protected_settings = jsonencode({
            "AADClientID"     = "SERVICE_PRINCIPAL_APP_ID"         # if using AAD app for Key Vault access
            "AADClientSecret" = "SERVICE_PRINCIPAL_CLIENT_SECRET"  # store in Terraform variables, not plaintext
          })
        }
        ```

        * Substitute:
          * `azurerm_virtual_machine.TARGET_VM` with the Azure VM resource you need to remediate.
          * `azurerm_key_vault.ADE_KEY_VAULT` and `azurerm_key_vault_key.ADE_KEK` with your Key Vault and key resources, or hard-code the full URLs/IDs as comments indicate.
          * `SERVICE_PRINCIPAL_APP_ID` and `SERVICE_PRINCIPAL_CLIENT_SECRET` with credentials that have access to the Key Vault (preferably from variables or a key vault, not inline).

        This change adds an extension to the existing VM and does not force replacement of the VM itself; the extension will cause the VM’s data (non‑boot) disks to be encrypted in place and may trigger a reboot, which is an operational outage window even though the VM resource is not recreated.

        For verification, `terraform plan` should show a single `+` (create) for `azurerm_virtual_machine_extension.DATA_DISK_ADE` attached to the target VM, with no `-` (destroy) and no `-/+` (replace) on the VM resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>