> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Infrastructure Double Encryption

### More Info:

Ensure that infrastructure double encryption is enabled for your Azure PostgreSQL database servers in order to add a second layer of encryption for your PostgreSQL databases using a different encryption algorithm which provides enhanced data protection.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AZURE
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Enable Infrastructure Double Encryption" in Azure using Azure Console, follow the below steps:

        1. Login to the Azure Portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Click on the "Virtual machines" option from the left-hand menu.
        3. Select the virtual machine that you want to remediate.
        4. Click on the "Disks" option from the left-hand menu.
        5. Select the disk that you want to remediate.
        6. Click on the "Disk Encryption" option from the left-hand menu.
        7. Click on the "Enable encryption" button.
        8. Select the key vault that you want to use for encryption.
        9. Click on the "Save" button to enable encryption.

        By following these steps, you can remediate the misconfiguration "Enable Infrastructure Double Encryption" in Azure using Azure Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of enabling infrastructure double encryption in AZURE using AZURE CLI, please follow the below steps:

        1. Open the AZURE CLI in your terminal or command prompt.
        2. Login to your AZURE account using the command "az login".
        3. Select the subscription in which the infrastructure needs to be double encrypted using the command `az account set --subscription <subscription-id>`
        4. Enable the infrastructure double encryption by creating a new storage account with encryption enabled using the command `az storage account create --name <storage-account-name> --resource-group <resource-group-name> --location <location> --sku Standard_LRS --encryption-services blob --encryption blob`.
        5. Verify that the infrastructure double encryption is enabled by checking the encryption status of the storage account using the command `az storage account show --name <storage-account-name> --resource-group <resource-group-name> --query "encryption.services.blob.enabled"`.

        By doing the above steps, you have successfully remediated the misconfiguration of enabling infrastructure double encryption in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enable Infrastructure Double Encryption in Azure using Python, you can follow these steps:

        1. Install the Azure SDK for Python using pip:

           ```
           pip install azure-mgmt-storage
           ```

        2. Import the necessary modules:

           ```python theme={null}
           from azure.common.credentials import ServicePrincipalCredentials
           from azure.mgmt.storage import StorageManagementClient
           from azure.mgmt.storage.models import StorageAccountUpdateParameters
           from azure.mgmt.storage.models import Encryption
           from azure.mgmt.storage.models import EncryptionService
           from azure.mgmt.storage.models import EncryptionServiceType
           ```

        3. Set up the Azure credentials:

           ```python theme={null}
           credentials = ServicePrincipalCredentials(
               client_id='<client-id>',
               secret='<client-secret>',
               tenant='<tenant-id>'
           )
           ```

        4. Create a StorageManagementClient object:

           ```python theme={null}
           storage_client = StorageManagementClient(credentials, subscription_id)
           ```

        5. Get the storage account that you want to enable Infrastructure Double Encryption for:

           ```python theme={null}
           storage_account = storage_client.storage_accounts.get_properties(resource_group_name, account_name)
           ```

        6. Create an Encryption object with the necessary properties:

           ```python theme={null}
           encryption = Encryption(
               services=[
                   EncryptionService(
                       service=EncryptionServiceType.blob,
                       enabled=True
                   ),
                   EncryptionService(
                       service=EncryptionServiceType.file,
                       enabled=True
                   )
               ]
           )
           ```

        7. Create a StorageAccountUpdateParameters object with the Encryption object:

           ```python theme={null}
           update_params = StorageAccountUpdateParameters(
               encryption=encryption
           )
           ```

        8. Update the storage account with the StorageAccountUpdateParameters object:

           ```python theme={null}
           storage_client.storage_accounts.update(resource_group_name, account_name, update_params)
           ```

        These steps will enable Infrastructure Double Encryption for the specified storage account in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_postgresql_server" "example" {
          name                = "POSTGRES_SERVER_NAME"          # replace with your server name
          location            = azurerm_resource_group.example.location
          resource_group_name = azurerm_resource_group.example.name

          sku_name   = "GP_Gen5_4"
          version    = "11"
          storage_mb = 51200

          administrator_login          = "POSTGRES_ADMIN_USERNAME"   # replace
          administrator_login_password = "POSTGRES_ADMIN_PASSWORD"   # replace

          ssl_enforcement_enabled = true

          # Enable infrastructure double encryption
          infrastructure_encryption_enabled = true
        }
        ```

        Replace `POSTGRES_SERVER_NAME`, `POSTGRES_ADMIN_USERNAME`, and `POSTGRES_ADMIN_PASSWORD` with your values, and wire the resource group as appropriate.

        Note: `infrastructure_encryption_enabled` can only be set at creation time; enabling it on an existing `azurerm_postgresql_server` forces replacement of the server (and thus a brief outage and data migration requirement). Plan this change accordingly.

        To verify, `terraform plan` should show a `+ create` for a new `azurerm_postgresql_server` (and `-/+` or `- destroy` for the old one if it already exists) with `infrastructure_encryption_enabled: "false" => "true"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>