Storage account should use customer-managed keys

Medium Azure General storage-cmk

Applies to

Microsoft.Storage/storageAccounts

What CGPulse checks

A resource passes this rule when encryption.keySource must equal Microsoft.Keyvault. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure customer-managed keys via Key Vault for full control over encryption key lifecycle. In Azure Portal: Storage account > Encryption > select Customer-managed key. See: https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview

CLI

az storage account show --ids "{id}" --query "encryption.keySource" -o tsv

Bicep

param keyVaultUri string   // e.g. https://mykeyvault.vault.azure.net
param keyName string       // Key name in the Key Vault

resource sa 'Microsoft.Storage/storageAccounts@2023-05-01' existing = {{
  name: '{name}'
}}
// TODO: 1. Create a Key Vault key
//       2. Grant Storage account access to Key Vault
//       3. Update storage encryption to use the key

Terraform

# Customer-managed keys require Key Vault + key + access policy
resource "azurerm_storage_account_customer_managed_key" "{name}" {
  storage_account_id = "{id}"
  key_vault_id       = var.key_vault_id
  key_name           = var.key_name
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan