Synapse workspace should enable double encryption

Medium Azure General synapse-encryption

Applies to

Microsoft.Synapse/workspaces

What CGPulse checks

A resource passes this rule when encryption.doubleEncryptionEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable encryption at rest to protect stored data from media compromise. In Azure Portal: Workspace > Encryption > enable encryption. See: https://learn.microsoft.com/en-us/azure/machine-learning/concept-data-encryption

CLI

az synapse workspace update --ids "{id}" --key-name "<cmk-key-name>" --encryption-key-name "<cmk-key-name>"

Bicep

resource synapseWorkspace 'Microsoft.Synapse/workspaces@2021-06-01' = {
  name: '{name}'
  location: location
  properties: {
    defaultDataLakeStorage: {
      accountUrl: '<storage-account-url>'
      filesystem: '<filesystem-name>'
    }
    encryption: {
      doubleEncryptionEnabled: true
      cmk: {
        key: { name: 'var.key_name', keyVaultUrl: '<key-vault-key-url>' }
      }
    }
  }
  identity: { type: 'SystemAssigned' }
}

Terraform

resource "azurerm_synapse_workspace" "{name}" {
  name                                 = "{name}"
  resource_group_name                  = "{rg}"
  location                             = var.location
  storage_data_lake_gen2_filesystem_id = "<adls-filesystem-id>"
  sql_administrator_login              = "<admin-login>"
  sql_administrator_login_password     = "<admin-password>"
  customer_managed_key {
    key_versionless_id = "<key-vault-key-id>"
    key_name           = var.key_name
  }
  identity {
    type = "SystemAssigned"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan