> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Server side encryption boot disk cmk remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure, follow the below steps: 1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)) 2. Navigate to the virtual machine which needs to be remediated. 3. Click on "Disks" under the "Settings" section of the virtual machine. 4. Select the boot disk that needs to be encrypted. 5. In the "Encryption Settings" section, click on "Disk encryption set". 6. Click on "Create new" to create a new disk encryption set. 7. Select the appropriate subscription, resource group and region. 8. Provide a name for the disk encryption set and select the key vault which contains the Customer Managed Key (CMK). 9. Click on "Create" to create the disk encryption set. 10. Once the disk encryption set is created, select the disk encryption set from the "Encryption Settings" section of the boot disk. 11. Click on "Save" to save the changes. The boot disk of the virtual machine will now be encrypted using the Customer Managed Key (CMK) stored in the selected key vault. # To remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure, you can follow the below steps using Azure CLI: 1. Open Azure CLI and login to your Azure account using the command: `az login` 2. Once you are logged in, run the following command to identify the VM's boot disk that needs to be encrypted: `az vm show -g -n --query storageProfile.osDisk.managedDisk.id -o tsv` 3. Once you have identified the boot disk, run the following command to enable encryption on the boot disk using a customer-managed key: `az disk encryption set --resource-group --name --key-url --encryption-type ` Replace the following parameters in the command: * ``: Name of the resource group where the VM is located. * ``: Name of the disk that needs to be encrypted. * ``: URL of the customer-managed key that needs to be used for encryption. * ``: Type of encryption to be used. In this case, it would be "EncryptionAtRestWithCustomerKey". 4. Once the encryption is enabled, you can verify the status of the encryption using the following command: `az disk encryption show --resource-group --name --query encryptionSettingsCollection -o json` This command will return the encryption settings for the disk in JSON format. By following the above steps, you can remediate the misconfiguration of Server Side Encryption for Boot Disk using CMK in Azure using Azure CLI. To remediate Server Side Encryption for Boot Disk using CMK misconfiguration in Azure using Python, you can follow the below steps: 1. Import the necessary libraries: ```python theme={null} from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.compute.models import DiskEncryptionSetParameters, EncryptionSettings, DiskEncryptionSettings, KeyVaultSecretReference from azure.identity import DefaultAzureCredential ``` 2. Set the credentials for authentication: ```python theme={null} credential = DefaultAzureCredential() subscription_id = 'your-subscription-id' resource_group = 'your-resource-group' ``` 3. Create an instance of the ComputeManagementClient: ```python theme={null} compute_client = ComputeManagementClient(credential, subscription_id) ``` 4. Get the virtual machine details: ```python theme={null} vm_name = 'your-vm-name' vm = compute_client.virtual_machines.get(resource_group, vm_name) ``` 5. Get the OS disk details: ```python theme={null} os_disk_name = vm.storage_profile.os_disk.name os_disk = compute_client.disks.get(resource_group, os_disk_name) ``` 6. Create a DiskEncryptionSetParameters object: ```python theme={null} disk_encryption_set_parameters = DiskEncryptionSetParameters( identity=None, encryption_type='EncryptionAtRestWithCustomerKey', disk_encryption_key=None, key_encryption_key=None ) ``` 7. Create an EncryptionSettings object: ```python theme={null} encryption_settings = EncryptionSettings( enabled=True, disk_encryption_set_id='your-disk-encryption-set-id' ) ``` 8. Create a DiskEncryptionSettings object: ```python theme={null} disk_encryption_settings = DiskEncryptionSettings( disk_encryption_key=None, key_encryption_key=None, enabled=True, encryption_settings=encryption_settings ) ``` 9. Create a KeyVaultSecretReference object: ```python theme={null} key_vault_secret_reference = KeyVaultSecretReference( source_vault=None, secret_url='your-cmk-secret-url' ) ``` 10. Update the OS disk with the new encryption settings: ```python theme={null} os_disk.encryption_settings = disk_encryption_settings os_disk.encryption_settings.disk_encryption_settings.disk_encryption_key.secret_url = key_vault_secret_reference.secret_url os_disk.encryption_settings.disk_encryption_settings.disk_encryption_key.source_vault = key_vault_secret_reference.source_vault compute_client.disks.create_or_update(resource_group, os_disk_name, os_disk) ``` Note: Make sure to replace the placeholders (your-subscription-id, your-resource-group, your-vm-name, your-disk-encryption-set-id, your-cmk-secret-url) with the actual values. These steps will remediate the Server Side Encryption for Boot Disk using CMK misconfiguration in Azure using Python. ```hcl theme={null} # Customer-managed key in Key Vault resource "azurerm_key_vault_key" "VM_BOOT_DISK_CMK" { name = "VM-BOOT-DISK-CMK" key_vault_id = azurerm_key_vault.VM_KEY_VAULT_ID # replace with your Key Vault resource or ID key_type = "RSA" key_size = 2048 key_opts = [ "encrypt", "decrypt", ] } # Disk Encryption Set that uses the CMK resource "azurerm_disk_encryption_set" "VM_BOOT_DISK_DES" { name = "vm-boot-disk-des" location = azurerm_resource_group.RG.location # replace with your RG resource resource_group_name = azurerm_resource_group.RG.name # replace with your RG resource identity { type = "SystemAssigned" } key_vault_key_id = azurerm_key_vault_key.VM_BOOT_DISK_CMK.id } # Grant the DES access to the Key Vault key (example using access policy) resource "azurerm_key_vault_access_policy" "VM_BOOT_DISK_DES_POLICY" { key_vault_id = azurerm_key_vault.VM_KEY_VAULT_ID.id # replace with your Key Vault resource tenant_id = azurerm_disk_encryption_set.VM_BOOT_DISK_DES.identity[0].tenant_id object_id = azurerm_disk_encryption_set.VM_BOOT_DISK_DES.identity[0].principal_id key_permissions = [ "get", "wrapKey", "unwrapKey", ] } # Azure Compute VM using CMK for the boot (OS) disk encryption resource "azurerm_windows_virtual_machine" "VM_WITH_CMK_BOOT_DISK" { name = "vm-with-cmk-boot-disk" location = azurerm_resource_group.RG.location # replace with your RG resource resource_group_name = azurerm_resource_group.RG.name # replace with your RG resource size = "Standard_DS1_v2" admin_username = "ADMIN_USERNAME" # replace with admin username admin_password = "ADMIN_PASSWORD" # replace with admin password network_interface_ids = [ azurerm_network_interface.VM_NIC_ID, # replace with your NIC resource or ID ] os_disk { name = "vm-with-cmk-osdisk" caching = "ReadWrite" storage_account_type = "Premium_LRS" # This is the key setting that enables SSE with CMK for the boot disk disk_encryption_set_id = azurerm_disk_encryption_set.VM_BOOT_DISK_DES.id } source_image_reference { publisher = "MicrosoftWindowsServer" offer = "WindowsServer" sku = "2022-datacenter-azure-edition" version = "latest" } } ``` Substitute: * `azurerm_resource_group.RG` with your resource group. * `azurerm_key_vault.VM_KEY_VAULT_ID` with your Key Vault resource. * `azurerm_network_interface.VM_NIC_ID` with your NIC resource or ID. * `ADMIN_USERNAME` / `ADMIN_PASSWORD` with your secure values (ideally from variables). Changing `disk_encryption_set_id` on an existing OS disk forces replacement of the OS disk and typically the VM (expect downtime and recreation). To verify, `terraform plan` should show: * creation of `azurerm_disk_encryption_set.VM_BOOT_DISK_DES`; * a Key Vault access policy for its identity; * the VM’s `os_disk` gaining `disk_encryption_set_id` (or the VM being replaced with the new encrypted OS disk).