Disk Encryption Set should use EncryptionAtRestWithCustomerKey

Medium Azure General diskencryptionsets-encryption-at-rest

Applies to

Microsoft.Compute/diskEncryptionSets

What CGPulse checks

A resource passes this rule when encryptionType must be one of ["EncryptionAtRestWithCustomerKey","EncryptionAtRestWithPlatformAndCustomerKeys"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure customer-managed keys via Key Vault for full control over encryption key lifecycle. In Azure Portal: Disk Encryption Set > configure Key Vault key. See: https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-sets-overview

CLI

az disk-encryption-set update --ids "{id}" --key-url "<key-vault-key-versioned-url>"

Terraform

resource "azurerm_disk_encryption_set" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  key_vault_key_id    = "<key-vault-key-id>"
  encryption_type     = "EncryptionAtRestWithCustomerKey"

  identity {
    type = "SystemAssigned"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan