HDInsight cluster should enable encryption in transit

High Azure General clusters-encryption-in-transit

Applies to

Microsoft.HDInsight/clusters

What CGPulse checks

A resource passes this rule when encryptionInTransit must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable encryption in transit to protect data from interception. In Azure Portal: Resource > Settings > enable TLS/encryption in transit. See: https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview

CLI

az hdinsight update --ids "{id}" --encryption-in-transit true

Bicep

// Encryption in transit must be set at creation time
resource hdinsight 'Microsoft.HDInsight/clusters@2024-08-01-preview' = {{
  name: '{name}'
  location: resourceGroup().location
  properties: {{
    clusterDefinition: {{
      kind: 'Spark'
    }}
    encryptionInTransitProperties: {{
      isEncryptionInTransitEnabled: true
    }}
  }}
}}

Terraform

resource "azurerm_hdinsight_spark_cluster" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  cluster_version     = "5.1"
  tier                = "Standard"
  encryption_in_transit_enabled = true
  component_version {
    spark = "3.3"
  }
  roles {
    head_node {
      vm_size  = "Standard_D12_v2"
      username = "admin"
    }
    worker_node {
      vm_size               = "Standard_D12_v2"
      username              = "admin"
      target_instance_count = 3
    }
  }
  gateway {
    username = "admin"
    password = "<password>"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan