Storage Account Encryption using Customer Managed Keys
More Info:
Ensure that your Microsoft Azure Storage accounts are using Customer Managed Keys (CMKs) instead of Microsoft Managed KeysRisk Level
HighAddress
SecurityCompliance Standards
HIPAA, HITRUST, GDPR, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the Storage Account Encryption misconfiguration using Customer Managed Keys in Azure:
- Login to Azure Portal (https://portal.azure.com/)
- Navigate to the Storage Account for which you want to enable encryption using Customer Managed Keys.
- Click on the ‘Encryption’ option under the ‘Settings’ section in the left-hand side menu.
- Under the ‘Encryption’ tab, select the ‘Customer-managed key’ option.
- Click on the ‘Select’ button to choose an existing Key Vault or create a new one.
- If you want to create a new Key Vault, click on the ‘Create new’ button and provide the required details.
- Once you have selected the Key Vault, select the key that you want to use for encryption.
- Click on the ‘Save’ button to save the changes.
Using CLI
Using CLI
To remediate the storage account encryption misconfiguration using Customer Managed Keys in Azure using Azure CLI, follow these steps:
- Open the Azure CLI in your terminal or command prompt.
-
Login to your Azure account using the following command:
-
Set the subscription where the storage account is located using the following command:
Replace
<subscription_id>with the ID of your subscription. - Get the resource group name and the name of the storage account that needs to be remediated.
-
Check if Customer Managed Keys are available in the Key Vault using the following command:
Replace
<key_vault_name>with the name of your Key Vault. -
Create a new key in the Key Vault if it is not available using the following command:
Replace
<key_vault_name>with the name of your Key Vault and<key_name>with the name of the key you want to create. -
Get the key identifier using the following command:
Replace
<key_vault_name>with the name of your Key Vault and<key_name>with the name of the key you created. -
Set the storage account encryption using the Customer Managed Key using the following command:
Replace
<storage_account_name>with the name of your storage account,<resource_group_name>with the name of your resource group,<key_name>with the name of the key you created, and<key_vault_url>with the URL of your Key Vault. -
Verify that the storage account encryption using Customer Managed Keys is enabled using the following command:
Replace
<storage_account_name>with the name of your storage account and<resource_group_name>with the name of your resource group.
Using Python
Using Python
To remediate the misconfiguration of Storage Account Encryption using Customer Managed Keys in AZURE using python, you can follow the below steps:This code will enable encryption using the specified Customer Managed Key for the specified Storage Account.
- First, you need to ensure that you have a valid Customer Managed Key available in your Key Vault. If not, you can create one using the Azure Portal or Azure CLI.
- Next, you need to get the details of the Storage Account that needs to be remediated. You can use the Azure SDK for Python to get the details of the Storage Account.
- Once you have the details of the Storage Account, you need to ensure that the encryption is enabled and set to use the Customer Managed Key. You can use the Azure SDK for Python to enable encryption and set the Customer Managed Key.