Server Side Encryption for Non-Boot Disk using CMK
More Info:
Microsoft Azure provides multiple distinct layers of encryption protection for virtual machine (VM) managed disks. VM managed disks are encrypted with Azure Storage encryption, also known as Server-Side Encryption (SSE), using platform-managed keys (PMK), to protect your data at rest and help you meet your organizational security and compliance commitments. By default, VM managed disk volumes (OS and data disk volumes) use platform-managed encryption keys.Risk Level
HighAddress
SecurityCompliance Standards
ISO27001, HIPAATriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the misconfiguration:
- Log in to the Azure portal using your credentials.
- Navigate to the virtual machine that has the misconfiguration.
- Click on the “Disks” option from the left-hand side menu.
- Select the non-boot disk that requires encryption.
- Click on the “Disk encryption” option from the top menu.
- Select “Customer-managed key” for the encryption type.
- Select the key that you want to use for encryption from the list of available keys.
- Click on “Save” to apply the changes.
- Wait for the encryption process to complete. This may take a few minutes.
- Once the encryption process is complete, verify that the disk is now encrypted by checking the “Encryption status” column on the “Disks” page.
Using CLI
Using CLI
To remediate the misconfiguration “Server Side Encryption for Non-Boot Disk using CMK” for AZURE using AZURE CLI, please follow the below steps:Step 1: Open the Azure CLI on your local machine.Step 2: Run the following command to list all the disks in your subscription:Step 3: Identify the disk that is not using Server-Side Encryption with Customer-Managed Keys (CMK).Step 4: Run the following command to enable Server-Side Encryption with CMK for the identified disk:Note: Replace The output should be
<resource-group-name> with the name of the resource group that contains the disk, <disk-name> with the name of the disk, <key-vault-name> with the name of the Key Vault, and <key-name> with the name of the key.Step 5: Verify that the disk is now using Server-Side Encryption with CMK by running the following command:EncryptionAtRestWithCustomerKey.Step 6: Repeat the above steps for all the disks in your subscription that are not using Server-Side Encryption with CMK.By following the above steps, you can remediate the misconfiguration “Server Side Encryption for Non-Boot Disk using CMK” for AZURE using AZURE CLI.Using Python
Using Python
To remediate the misconfiguration of Server Side Encryption for Non-Boot Disk using CMK in AZURE using python, you can follow the below steps:Note: Replace the placeholders
- Import the required libraries:
- Authenticate with Azure using DefaultAzureCredential:
- Get the list of all the virtual machines in the subscription:
- Loop through all the virtual machines and get the disks attached to them:
- Check if the disks have server-side encryption enabled:
- If the disk is not encrypted with CMK, enable encryption using the following code:
your_subscription_id, resource_group_name, key_vault_name, key_name, key_version, and account_name with your own values.These steps should help you remediate the misconfiguration of Server Side Encryption for Non-Boot Disk using CMK in AZURE using python.