Enable Infrastructure Double Encryption

Using Console

To remediate the misconfiguration “Enable Infrastructure Double Encryption” in Azure using Azure Console, follow the below steps:

Login to the Azure Portal (https://portal.azure.com/)
Click on the “Virtual machines” option from the left-hand menu.
Select the virtual machine that you want to remediate.
Click on the “Disks” option from the left-hand menu.
Select the disk that you want to remediate.
Click on the “Disk Encryption” option from the left-hand menu.
Click on the “Enable encryption” button.
Select the key vault that you want to use for encryption.
Click on the “Save” button to enable encryption.

By following these steps, you can remediate the misconfiguration “Enable Infrastructure Double Encryption” in Azure using Azure Console.

Using CLI

To remediate the misconfiguration of enabling infrastructure double encryption in AZURE using AZURE CLI, please follow the below steps:

Open the AZURE CLI in your terminal or command prompt.
Login to your AZURE account using the command “az login”.
Select the subscription in which the infrastructure needs to be double encrypted using the command az account set --subscription <subscription-id>
Enable the infrastructure double encryption by creating a new storage account with encryption enabled using the command az storage account create --name <storage-account-name> --resource-group <resource-group-name> --location <location> --sku Standard_LRS --encryption-services blob --encryption blob.
Verify that the infrastructure double encryption is enabled by checking the encryption status of the storage account using the command az storage account show --name <storage-account-name> --resource-group <resource-group-name> --query "encryption.services.blob.enabled".

By doing the above steps, you have successfully remediated the misconfiguration of enabling infrastructure double encryption in AZURE using AZURE CLI.

Using Python

To enable Infrastructure Double Encryption in Azure using Python, you can follow these steps:

Install the Azure SDK for Python using pip:
pip install azure-mgmt-storage

Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.storage import StorageManagementClient
from azure.mgmt.storage.models import StorageAccountUpdateParameters
from azure.mgmt.storage.models import Encryption
from azure.mgmt.storage.models import EncryptionService
from azure.mgmt.storage.models import EncryptionServiceType

Set up the Azure credentials:

credentials = ServicePrincipalCredentials(
    client_id='<client-id>',
    secret='<client-secret>',
    tenant='<tenant-id>'
)

Create a StorageManagementClient object:

storage_client = StorageManagementClient(credentials, subscription_id)

Get the storage account that you want to enable Infrastructure Double Encryption for:

storage_account = storage_client.storage_accounts.get_properties(resource_group_name, account_name)

Create an Encryption object with the necessary properties:

encryption = Encryption(
    services=[
        EncryptionService(
            service=EncryptionServiceType.blob,
            enabled=True
        ),
        EncryptionService(
            service=EncryptionServiceType.file,
            enabled=True
        )
    ]
)

Create a StorageAccountUpdateParameters object with the Encryption object:

update_params = StorageAccountUpdateParameters(
    encryption=encryption
)

Update the storage account with the StorageAccountUpdateParameters object:

storage_client.storage_accounts.update(resource_group_name, account_name, update_params)

These steps will enable Infrastructure Double Encryption for the specified storage account in Azure using Python.

Using Terraform

resource "azurerm_postgresql_server" "example" {
  name                = "POSTGRES_SERVER_NAME"          # replace with your server name
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  sku_name   = "GP_Gen5_4"
  version    = "11"
  storage_mb = 51200

  administrator_login          = "POSTGRES_ADMIN_USERNAME"   # replace
  administrator_login_password = "POSTGRES_ADMIN_PASSWORD"   # replace

  ssl_enforcement_enabled = true

  # Enable infrastructure double encryption
  infrastructure_encryption_enabled = true
}

Replace POSTGRES_SERVER_NAME, POSTGRES_ADMIN_USERNAME, and POSTGRES_ADMIN_PASSWORD with your values, and wire the resource group as appropriate.Note: infrastructure_encryption_enabled can only be set at creation time; enabling it on an existing azurerm_postgresql_server forces replacement of the server (and thus a brief outage and data migration requirement). Plan this change accordingly.To verify, terraform plan should show a + create for a new azurerm_postgresql_server (and -/+ or - destroy for the old one if it already exists) with infrastructure_encryption_enabled: "false" => "true".

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Enable Infrastructure Double Encryption

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​