📝 Azure Databricks Workspace is not encrypted using customer-managed key (CMK) 🟢

• Contextual name: 📝 Workspace is not encrypted using customer-managed key (CMK) 🟢
• ID: /ce/ca/azure/databricks/customer-managed-keys
• Located in: 📁 Azure Databricks

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Azure Databricks Workspace
  • 🔌 Azure Databricks Workspace - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Azure Databricks encrypts data in transit using TLS 1.2+ to secure API, workspace, and cluster communications. By default, data at rest is encrypted using Microsoft-managed keys.

Rationale

Organizations with stricter needs for control of encryption keys should enable customer-managed keys (CMK) for greater control over data encryption, auditing, and regulatory compliance. Azure Key Vault should be used to store and manage CMKs. Enforcing encryption at rest and in transit in Azure Databricks:

• Protects sensitive data from unauthorized access.
• Ensures regulatory compliance (ISO 27001, GDPR, HIPAA, SOC 2).
• Allows key revocation and rotation control with customer-managed keys (CMK).
• Mitigates insider threats by preventing unauthorized access to raw storage.

Impact

Enabling CMK encryption requires additional configuration. Key management introduces maintenance overhead (rotation, revocation, lifecycle management). Potential access issues will be encountered if keys are deleted or rotated incorrectly.

... see more

Remediation

Open File

Remediation

NOTE: These remediations assume that an Azure KeyVault already exists in the subscription.

From Azure CLI

1. Create a dedicated key:

   az keyvault key create --vault-name <keyvault-name> --name <key-name> --protection <"software" or "hsm">

2. Assign permissions to Databricks:

   az keyvault set-policy --name <keyvault-name> --resource-group <resource-group-name> --spn <databricks-spn> --key-permissions get wrapKey unwrapKey

3. Enable encryption with CMK:

   az databricks workspace update --name <databricks-workspace-name> --resource-group <resource-group-name> --key-source "Microsoft.KeyVault" --key-name <key-name> --keyvault-uri <keyvault-uri>

From PowerShell

$Key = Add-AzKeyVaultKey -VaultName <keyvault-name> -Name <key-name> -Destination <"software" or "hsm"> Set-AzDatabricksWorkspace -ResourceGroupName "<resource-group-name>" -WorkspaceName "<databricks-workspace-name>" -EncryptionKeySource "Microsoft.KeyVault" -KeyVaultUri $Key.Id

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v4.0.0 → 💼 3.1.8 Ensure that data at rest and in transit is encrypted in Azure Databricks using customer managed keys (CMK) (Automated)			1
💼 Cloudaware Framework → 💼 Data Encryption			40