Virtual Machine must enable encryption at host

Applies to

• Microsoft.Compute/virtualMachines

What CGPulse checks

A resource passes this rule when securityProfile.encryptionAtHost must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable encryption at host to encrypt temp disks and disk caches at rest. In Azure Portal: VM > Disks > Additional settings > enable Encryption at host. See: https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#encryption-at-host

CLI

az vm update --ids "{id}" --set securityProfile.encryptionAtHost=true

Terraform

resource "azurerm_linux_virtual_machine" "{name}" {
  encryption_at_host_enabled = true
}

Compliance frameworks

• Critical Security Controls v87.3
• NIST 800-53: Cloud Security ControlsSC-28
• SOC 2: Trust ServicesCC7.1

Related Azure rules

• Action Group should be enabled
• Activity Log Alert should be enabled
• AKS cluster logs should be sent to Log Analytics
• AKS cluster must enable RBAC
• AKS cluster must enable RBAC
• AKS cluster should be a private cluster
• AKS cluster should disable local accounts
• AKS cluster should enable Azure RBAC for Kubernetes