📝 Azure Diagnostic Setting Logs export to Storage Account not encrypted with Customer-managed key 🟢

• Contextual name: 📝 Diagnostic Setting Logs export to Storage Account not encrypted with Customer-managed key 🟢
• ID: /ce/ca/azure/monitor/diagnostic-logs-export-to-storage-without-cmk
• Located in: 📁 Azure Monitor

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Internal
  • dec-x-5c3c2067

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-5c3c2067	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure Diagnostic Setting
  • 🔌 Azure Storage Account - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).

Rationale

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Impact

NOTE: You must have your key vault setup to utilize this. All Audit Logs will be encrypted with a key you provide. You will need to set up customer managed keys separately, and you will select which key to use via the instructions here. You will be responsible for the lifecycle of the keys, and will need to manually replace them at your own determined intervals to keep the data secure.

Audit

From Azure Portal

1. Go to Monitor.
2. Select Activity log.
3. Select Export Activity Logs.
4. Select a Subscription.
5. Note the name of the Storage Account for the diagnostic setting.
6. Navigate to Storage accounts.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Monitor.
2. Select Activity log.
3. Select Export Activity Logs.
4. Select a Subscription.
5. Note the name of the Storage Account for the diagnostic setting.
6. Navigate to Storage accounts.
7. Click on the storage account.
8. Under Security + networking, click Encryption.
9. Next to Encryption type, select Customer-managed keys.
10. Complete the steps to configure a customer-managed key for encryption of the storage account.

From Azure CLI

az storage account update --name <name of the storage account> --resource-group <resource group for a storage account> --encryption-key-source=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> --encryption-key-name <KeyName> --encryption-key-version <Key Version>

From PowerShell

Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <key name>

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 APRA CPG 234 → 💼 52c appropriate encryption, cleansing and auditing of devices;		9	9
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).		17	18
💼 CIS Azure v1.1.0 → 💼 5.1.6 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key)		1	1
💼 CIS Azure v1.3.0 → 💼 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key) - Level 2 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with BYOK (Use Your Own Key) - Level 2 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key - Level 2 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 5.1.4 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key - Level 2 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 5.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK) - Level 2 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 6.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK) (Automated)			1
💼 Cloudaware Framework → 💼 Data Encryption			31
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			49
💼 FedRAMP High Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)		37	47
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		20	21
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)		13	16
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1	7	17
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)		5	12
💼 FedRAMP Low Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)			47
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 FedRAMP Moderate Security Controls → 💼 AC-3 Access Enforcement (L)(M)(H)			47
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)			16
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls		14	15
💼 ISO/IEC 27001:2022 → 💼 5.33 Protection of records		10	10
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	19
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented		43	51
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			67
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest	3	15	18
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection		10	12
💼 PCI DSS v3.2.1 → 💼 3.4.1 If disk encryption is used, logical access must be managed separately and independently of native operating system authentication and access control mechanisms.		7	7
💼 PCI DSS v4.0.1 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7
💼 PCI DSS v4.0 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.			7