> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Server Side Encryption for Boot Disk using CMK ### More Info: Microsoft Azure provides multiple distinct layers of encryption protection for virtual machine (VM) managed disks. VM managed disks are encrypted with Azure Storage encryption, also known as Server-Side Encryption (SSE), using platform-managed keys (PMK), to protect your data at rest and help you meet your organizational security and compliance commitments. By default, VM managed disk volumes (OS and data disk volumes) use platform-managed encryption keys. ### Risk Level High ### Address Security ### Compliance Standards ISO27001, HIPAA, CISAZURE, CBP ### Triage and Remediation ### Remediation To remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure, follow the below steps: 1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)) 2. Navigate to the virtual machine which needs to be remediated. 3. Click on "Disks" under the "Settings" section of the virtual machine. 4. Select the boot disk that needs to be encrypted. 5. In the "Encryption Settings" section, click on "Disk encryption set". 6. Click on "Create new" to create a new disk encryption set. 7. Select the appropriate subscription, resource group and region. 8. Provide a name for the disk encryption set and select the key vault which contains the Customer Managed Key (CMK). 9. Click on "Create" to create the disk encryption set. 10. Once the disk encryption set is created, select the disk encryption set from the "Encryption Settings" section of the boot disk. 11. Click on "Save" to save the changes. The boot disk of the virtual machine will now be encrypted using the Customer Managed Key (CMK) stored in the selected key vault. # To remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure, you can follow the below steps using Azure CLI: 1. Open Azure CLI and login to your Azure account using the command: `az login` 2. Once you are logged in, run the following command to identify the VM's boot disk that needs to be encrypted: `az vm show -g -n --query storageProfile.osDisk.managedDisk.id -o tsv` 3. Once you have identified the boot disk, run the following command to enable encryption on the boot disk using a customer-managed key: `az disk encryption set --resource-group --name --key-url --encryption-type ` Replace the following parameters in the command: * ``: Name of the resource group where the VM is located. * ``: Name of the disk that needs to be encrypted. * ``: URL of the customer-managed key that needs to be used for encryption. * ``: Type of encryption to be used. In this case, it would be "EncryptionAtRestWithCustomerKey". 4. Once the encryption is enabled, you can verify the status of the encryption using the following command: `az disk encryption show --resource-group --name --query encryptionSettingsCollection -o json` This command will return the encryption settings for the disk in JSON format. By following the above steps, you can remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure using Azure CLI. To remediate Server Side Encryption for Boot Disk using CMK misconfiguration in Azure using Python, you can follow the below steps: 1. Import the necessary libraries: ```python theme={null} from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.compute.models import DiskEncryptionSetParameters, EncryptionSettings, DiskEncryptionSettings, KeyVaultSecretReference from azure.identity import DefaultAzureCredential ``` 2. Set the credentials for authentication: ```python theme={null} credential = DefaultAzureCredential() subscription_id = 'your-subscription-id' resource_group = 'your-resource-group' ``` 3. Create an instance of the ComputeManagementClient: ```python theme={null} compute_client = ComputeManagementClient(credential, subscription_id) ``` 4. Get the virtual machine details: ```python theme={null} vm_name = 'your-vm-name' vm = compute_client.virtual_machines.get(resource_group, vm_name) ``` 5. Get the OS disk details: ```python theme={null} os_disk_name = vm.storage_profile.os_disk.name os_disk = compute_client.disks.get(resource_group, os_disk_name) ``` 6. Create a DiskEncryptionSetParameters object: ```python theme={null} disk_encryption_set_parameters = DiskEncryptionSetParameters( identity=None, encryption_type='EncryptionAtRestWithCustomerKey', disk_encryption_key=None, key_encryption_key=None ) ``` 7. Create an EncryptionSettings object: ```python theme={null} encryption_settings = EncryptionSettings( enabled=True, disk_encryption_set_id='your-disk-encryption-set-id' ) ``` 8. Create a DiskEncryptionSettings object: ```python theme={null} disk_encryption_settings = DiskEncryptionSettings( disk_encryption_key=None, key_encryption_key=None, enabled=True, encryption_settings=encryption_settings ) ``` 9. Create a KeyVaultSecretReference object: ```python theme={null} key_vault_secret_reference = KeyVaultSecretReference( source_vault=None, secret_url='your-cmk-secret-url' ) ``` 10. Update the OS disk with the new encryption settings: ```python theme={null} os_disk.encryption_settings = disk_encryption_settings os_disk.encryption_settings.disk_encryption_settings.disk_encryption_key.secret_url = key_vault_secret_reference.secret_url os_disk.encryption_settings.disk_encryption_settings.disk_encryption_key.source_vault = key_vault_secret_reference.source_vault compute_client.disks.create_or_update(resource_group, os_disk_name, os_disk) ``` Note: Make sure to replace the placeholders (your-subscription-id, your-resource-group, your-vm-name, your-disk-encryption-set-id, your-cmk-secret-url) with the actual values. These steps will remediate the Server Side Encryption for Boot Disk using CMK misconfiguration in Azure using Python.