Storage account must use customer-managed or Microsoft-managed encryption keys

Medium Azure General storage-encryption-2

Applies to

Microsoft.Storage/storageAccounts

What CGPulse checks

A resource passes this rule when encryption.keySource must be one of ["Microsoft.Storage","Microsoft.Keyvault"]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure customer-managed keys via Key Vault for full control over encryption key lifecycle. In Azure Portal: Resource > Encryption > select Customer-managed key. See: https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-models

CLI

az storage account show --ids "{id}" --query "encryption.keySource" -o tsv

Bicep

// Default: Microsoft-managed keys (keySource: 'Microsoft.Storage')
// For CMK: configure Key Vault key

param keyVaultUri string
param keyName string

resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' = {{
  name: '{name}'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: {{ name: 'Standard_LRS' }}
  properties: {{
    encryption: {{
      keySource: 'Microsoft.Keyvault'
      keyvaultproperties: {{
        keyname: keyName
        keyvaulturi: keyVaultUri
      }}
      services: {{
        blob: {{ enabled: true }}
        file: {{ enabled: true }}
      }}
    }}
  }}
  identity: {{
    type: 'SystemAssigned'
  }}
}}

Terraform

# Default: Microsoft-managed keys. For CMK, add customer_managed_key block
resource "azurerm_storage_account" "{name}" {
  name                     = "{name}"
  resource_group_name      = "{rg}"
  location                 = var.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
  identity {
    type = "SystemAssigned"
  }
}
# For customer-managed keys: # resource "azurerm_storage_account_customer_managed_key" "{name}" { #   storage_account_id = azurerm_storage_account.{name}.id #   key_vault_id       = azurerm_key_vault.{name}.id #   key_name           = azurerm_key_vault_key.{name}.name # }

Compliance frameworks

GDPR: Data Protection Controls

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan