> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Server side encryption non boot disk cmk remediation ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the misconfiguration: 1. Log in to the Azure portal using your credentials. 2. Navigate to the virtual machine that has the misconfiguration. 3. Click on the "Disks" option from the left-hand side menu. 4. Select the non-boot disk that requires encryption. 5. Click on the "Disk encryption" option from the top menu. 6. Select "Customer-managed key" for the encryption type. 7. Select the key that you want to use for encryption from the list of available keys. 8. Click on "Save" to apply the changes. 9. Wait for the encryption process to complete. This may take a few minutes. 10. Once the encryption process is complete, verify that the disk is now encrypted by checking the "Encryption status" column on the "Disks" page. Congratulations! You have now successfully remediated the misconfiguration by enabling server-side encryption for the non-boot disk using a customer-managed key in Azure. # To remediate the misconfiguration "Server Side Encryption for Non-Boot Disk using CMK" for AZURE using AZURE CLI, please follow the below steps: Step 1: Open the Azure CLI on your local machine. Step 2: Run the following command to list all the disks in your subscription: ``` az disk list ``` Step 3: Identify the disk that is not using Server-Side Encryption with Customer-Managed Keys (CMK). Step 4: Run the following command to enable Server-Side Encryption with CMK for the identified disk: ``` az disk update --resource-group --name --encryption-type EncryptionAtRestWithCustomerKey --disk-encryption-key $(az keyvault secret show --vault-name --name --query id -o tsv) ``` Note: Replace `` with the name of the resource group that contains the disk, `` with the name of the disk, `` with the name of the Key Vault, and `` with the name of the key. Step 5: Verify that the disk is now using Server-Side Encryption with CMK by running the following command: ``` az disk show --resource-group --name --query encryptionSettings.diskEncryptionKey.encryptionType ``` The output should be `EncryptionAtRestWithCustomerKey`. Step 6: Repeat the above steps for all the disks in your subscription that are not using Server-Side Encryption with CMK. By following the above steps, you can remediate the misconfiguration "Server Side Encryption for Non-Boot Disk using CMK" for AZURE using AZURE CLI. To remediate the misconfiguration of Server Side Encryption for Non-Boot Disk using CMK in AZURE using python, you can follow the below steps: 1. Import the required libraries: ``` from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.storage import StorageManagementClient ``` 2. Authenticate with Azure using DefaultAzureCredential: ``` credential = DefaultAzureCredential() subscription_id = 'your_subscription_id' compute_client = ComputeManagementClient(credential, subscription_id) storage_client = StorageManagementClient(credential, subscription_id) ``` 3. Get the list of all the virtual machines in the subscription: ``` vm_list = compute_client.virtual_machines.list_all() ``` 4. Loop through all the virtual machines and get the disks attached to them: ``` for vm in vm_list: disk_ids = [] for disk in vm.storage_profile.data_disks: disk_ids.append(disk.managed_disk.id) ``` 5. Check if the disks have server-side encryption enabled: ``` for disk_id in disk_ids: encryption = storage_client.disks.get_encryption_status(disk_id) if encryption.disk_encryption_key: print("Disk with ID {} is encrypted with CMK.".format(disk_id)) else: print("Disk with ID {} is not encrypted with CMK.".format(disk_id)) ``` 6. If the disk is not encrypted with CMK, enable encryption using the following code: ``` encryption_set_id = '/subscriptions/{}/resourceGroups/{}/providers/Microsoft.KeyVault/vaults/{}/encryptionKeys/{}/encryptionKeyVersions/{}'.format(subscription_id, resource_group_name, key_vault_name, key_name, key_version) encryption_settings = storage_client.encryption_services.get(resource_group_name, account_name, 'blob') encryption_settings.encryption_services[0].key_vault_properties.key_uri = encryption_set_id storage_client.encryption_services.create_or_update(resource_group_name, account_name, 'blob', encryption_settings) ``` Note: Replace the placeholders `your_subscription_id`, `resource_group_name`, `key_vault_name`, `key_name`, `key_version`, and `account_name` with your own values. These steps should help you remediate the misconfiguration of Server Side Encryption for Non-Boot Disk using CMK in AZURE using python. ```hcl theme={null} # Customer-managed key in Key Vault (substitute your own IDs/URIs) resource "azurerm_key_vault_key" "disk_cmk" { name = "DISK_CMK_NAME" # e.g. "disk-cmk" key_vault_id = azurerm_key_vault.kv.id # existing Key Vault resource key_type = "RSA" key_size = 2048 key_opts = ["wrapKey", "unwrapKey"] } # Disk Encryption Set using the CMK resource "azurerm_disk_encryption_set" "data_disk_des" { name = "DATA_DISK_DES_NAME" resource_group_name = azurerm_resource_group.rg.name location = azurerm_resource_group.rg.location key_vault_key_id = azurerm_key_vault_key.disk_cmk.id identity { type = "SystemAssigned" } } # Grant the DES managed identity rights to use the CMK resource "azurerm_key_vault_access_policy" "des_policy" { key_vault_id = azurerm_key_vault.kv.id tenant_id = azurerm_disk_encryption_set.data_disk_des.identity[0].tenant_id object_id = azurerm_disk_encryption_set.data_disk_des.identity[0].principal_id key_permissions = [ "get", "wrapKey", "unwrapKey", ] } # Managed data disk encrypted with CMK via Disk Encryption Set resource "azurerm_managed_disk" "data_disk" { name = "DATA_DISK_NAME" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name storage_account_type = "Premium_LRS" create_option = "Empty" disk_size_gb = 128 disk_encryption_set_id = azurerm_disk_encryption_set.data_disk_des.id } # VM with non-boot (data) disk attached that is encrypted with CMK resource "azurerm_linux_virtual_machine" "vm" { name = "VM_NAME" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name size = "VM_SIZE" # e.g. "Standard_D2s_v5" admin_username = "ADMIN_USERNAME" network_interface_ids = [ azurerm_network_interface.nic.id, ] disable_password_authentication = true os_disk { name = "OS_DISK_NAME" caching = "ReadWrite" storage_account_type = "Premium_LRS" # OS disk continues to use platform-managed keys unless separately configured } source_image_reference { publisher = "Canonical" offer = "0001-com-ubuntu-server-focal" sku = "20_04-lts" version = "latest" } # Non-boot data disk using CMK-encrypted managed disk data_disk { lun = 0 caching = "ReadOnly" disk_size_gb = azurerm_managed_disk.data_disk.disk_size_gb managed_disk_id = azurerm_managed_disk.data_disk.id storage_account_type = azurerm_managed_disk.data_disk.storage_account_type create_option = "Attach" } } ``` Changing an existing data disk to use a Disk Encryption Set and CMK (`disk_encryption_set_id` on `azurerm_managed_disk` or `data_disk`) forces replacement of that disk and its attachment, which can cause downtime; plan carefully and back up data. For verification, `terraform plan` should show: * creation of `azurerm_disk_encryption_set` and its identity, * a new or updated `azurerm_key_vault_access_policy` granting wrap/unwrap permissions, * a new `azurerm_managed_disk` (or replacement) with `disk_encryption_set_id` set, * the VM attaching that CMK-encrypted managed disk as its non-boot data disk.