> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Server side encryption unattached disk cmk remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration of Server Side Encryption for Unattached Disk using CMK in Azure:

        1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the Azure Disk Encryption extension.
        3. Click on "Disk Encryption Sets" on the left-hand side menu.
        4. Select the disk encryption set that you want to remediate.
        5. Click on the "Key vault" tab.
        6. Select the Key Vault that you want to use for encryption.
        7. Click on "Save" to save the changes.

        Once you have completed these steps, Azure will encrypt the unattached disks using the CMK specified in the Key Vault that you selected.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of server-side encryption for unattached disk using CMK in Azure using Azure CLI, you can follow these steps:

        1. Firstly, you need to identify the unattached disks in your Azure subscription. You can use the following Azure CLI command to list all the unattached disks:

           `az disk list --query "[?managedBy==null]"`

        2. Once you have identified the unattached disks, you can use the following Azure CLI command to enable server-side encryption for those disks using a customer-managed key (CMK):

           `az disk encryption set --resource-group <resource-group-name> --name <disk-name> --encryption-type EncryptionAtRestWithCustomerKey --disk-encryption-key <key-uri> --key-encryption-key <key-uri>`

           Here, replace `<resource-group-name>` with the name of the resource group containing the unattached disk, `<disk-name>` with the name of the unattached disk, `<key-uri>` with the URI of the customer-managed key (CMK) that you want to use for encryption.

        3. Once the encryption is enabled for the unattached disk, you can verify the encryption status using the following Azure CLI command:

           `az disk show --resource-group <resource-group-name> --name <disk-name> --query "encryptionSettings.collection[].diskEncryptionKey"`

           This command will show the encryption status of the disk and the key used for encryption.

        4. Repeat the above steps for all the unattached disks in your Azure subscription to ensure that they are all encrypted using a customer-managed key (CMK).

        By following the above steps, you can remediate the misconfiguration of server-side encryption for unattached disk using CMK in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of Server Side Encryption for Unattached Disk using CMK in Azure using Python, you can follow the below steps:

        1. Install the Azure SDK for Python using the following command:

        ```
        pip install azure-mgmt-compute
        ```

        2. Authenticate with Azure by creating a service principal and assigning the appropriate permissions.

        3. Use the following Python code to enable Server Side Encryption for Unattached Disk using CMK:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.compute import ComputeManagementClient
        from azure.mgmt.compute.models import DiskEncryptionSetParameters, EncryptionSetIdentity
        from azure.mgmt.resource import ResourceManagementClient

        # Set subscription ID, resource group name, disk name, and encryption set name
        subscription_id = '<subscription_id>'
        resource_group_name = '<resource_group_name>'
        disk_name = '<disk_name>'
        encryption_set_name = '<encryption_set_name>'

        # Set service principal credentials
        credentials = ServicePrincipalCredentials(
            client_id='<client_id>',
            secret='<client_secret>',
            tenant='<tenant_id>'
        )

        # Create compute and resource management clients
        compute_client = ComputeManagementClient(credentials, subscription_id)
        resource_client = ResourceManagementClient(credentials, subscription_id)

        # Get the resource ID of the disk
        disk = compute_client.disks.get(resource_group_name, disk_name)
        disk_id = disk.id

        # Get the resource ID of the encryption set
        encryption_set = resource_client.resources.get_by_id(encryption_set_name, api_version='2019-04-01')
        encryption_set_id = encryption_set.id

        # Create encryption set parameters
        encryption_set_params = DiskEncryptionSetParameters(
            identity=EncryptionSetIdentity(
                type='DiskEncryptionSetIdentity',
                resource_id=encryption_set_id
            )
        )

        # Update the disk with encryption set parameters
        compute_client.disks.update(
            resource_group_name=resource_group_name,
            disk_name=disk_name,
            disk_encryption_set=encryption_set_params
        )
        ```

        4. Replace the placeholders `<subscription_id>`, `<resource_group_name>`, `<disk_name>`, `<encryption_set_name>`, `<client_id>`, `<client_secret>`, and `<tenant_id>` with the appropriate values.

        5. Run the Python script to enable Server Side Encryption for Unattached Disk using CMK in Azure.

        Note: This code assumes that the disk and encryption set are in the same subscription and region. If they are in different subscriptions or regions, you will need to modify the code accordingly.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Customer-managed key (CMK) in Key Vault, referenced by a Disk Encryption Set
        resource "azurerm_disk_encryption_set" "DATA_DISK_DES" {
          name                = "DATA_DISK_DES_NAME"
          resource_group_name = "RESOURCE_GROUP_NAME"
          location            = "AZURE_REGION"

          key_vault_key_id = "KEY_VAULT_KEY_ID_FOR_CMK" # e.g. azurerm_key_vault_key.cmk.id

          identity {
            type = "SystemAssigned"
          }
        }

        # Unattached managed data disk encrypted with CMK via Disk Encryption Set
        resource "azurerm_managed_disk" "DATA_DISK" {
          name                 = "DATA_DISK_NAME"
          resource_group_name  = "RESOURCE_GROUP_NAME"
          location             = "AZURE_REGION"
          storage_account_type = "Premium_LRS"
          create_option        = "Empty"
          disk_size_gb         = 128

          # This switches from platform-managed keys to customer-managed keys (CMK)
          disk_encryption_set_id = azurerm_disk_encryption_set.DATA_DISK_DES.id
        }
        ```

        Substitute:

        * `DATA_DISK_DES_NAME` with the Disk Encryption Set name.
        * `RESOURCE_GROUP_NAME` with your resource group.
        * `AZURE_REGION` with the region (must match the disk’s region).
        * `KEY_VAULT_KEY_ID_FOR_CMK` with the full ID of your Key Vault key (CMK).
        * `DATA_DISK_NAME` with the managed disk name.

        Changing an existing disk from platform-managed keys to a Disk Encryption Set generally forces replacement of the `azurerm_managed_disk` resource, which can be disruptive; plan for data migration or recreation of the disk.

        Verification: `terraform plan` should show `disk_encryption_set_id` being added/changed on `azurerm_managed_disk.DATA_DISK`, and (for an existing disk) a `-/+` replacement of that disk resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>