AKS node pool should enable encryption at host

High Azure General agentpools-encryption

Applies to

Microsoft.ContainerService/managedClusters/agentPools

What CGPulse checks

A resource passes this rule when enableEncryptionAtHost must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable encryption at host to encrypt temp disks and disk caches at rest. In Azure Portal: VM > Disks > Additional settings > enable Encryption at host. See: https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#encryption-at-host

Careful: Enabling encryption at host requires recreating the node pool — existing nodes cannot be updated in place

CLI

az aks nodepool update --resource-group "{rg}" --cluster-name "{parent}" --name "{name}" --enable-encryption-at-host

Terraform

resource "azurerm_kubernetes_cluster_node_pool" "{name}" {
  name                   = "{name}"
  kubernetes_cluster_id  = "{id}"
  vm_size                = "Standard_DS2_v2"
  node_count             = 1
  enable_host_encryption = true
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan