📝 Azure SQL Server Transparent Data Encryption Protector is not encrypted with Customer-managed key 🟢

• Contextual name: 📝 Server Transparent Data Encryption Protector is not encrypted with Customer-managed key 🟢
• ID: /ce/ca/azure/sql-database/server-transparent-data-encryption-protector-with-cmk
• Located in: 📁 Azure SQL Database

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: BEST_PRACTICE
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Use BYOK for Transparent Data Encryption
• Internal
  • dec-x-230b5e35

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-230b5e35	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Azure SQL Server
  • 🔌 Azure SQL Server - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Transparent Data Encryption (TDE) with Customer-managed key support provides increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties.

With TDE, data is encrypted at rest with a symmetric key (called the database encryption key) stored in the database or data warehouse distribution. To protect this data encryption key (DEK) in the past, only a certificate that the Azure SQL Service managed could be used. Now, with Customer-managed key support for TDE, the DEK can be protected with an asymmetric key that is stored in the Azure Key Vault. The Azure Key Vault is a highly available and scalable cloud-based key store which offers central key management, leverages FIPS 140-2 Level 2 validated hardware security modules (HSMs), and allows separation of management of keys and data for additional security.

Based on business needs or criticality of data/databases hosted on a SQL server, it is recommended that the TDE protector is encrypted by a key that is managed by the data owner (Customer-managed key).

... see more

Remediation

Open File

Remediation

From Azure Console

1. Go to SQL servers.
2. For each SQL server, under Security, click Transparent data encryption.
3. Set Transparent data encryption to Customer-managed key.
4. Select a key or enter a key identifier.
5. Check Make this key the default TDE protector.
6. Click Save.

From Azure CLI

Use the below command to encrypt SQL server's TDE protector with a Customer-managed key:

az sql server tde-key set --resource-group <resourceName> --server <dbServerName> --server-key-type {AzureKeyVault} --kid <keyIdentifier>

From PowerShell

Use the below command to encrypt SQL server's TDE protector with a Customer-managed Key Vault key:

Set-AzSqlServerTransparentDataEncryptionProtector -Type AzureKeyVault -KeyId <KeyIdentifier> -ServerName <ServerName> -ResourceGroupName <ResourceGroupName>

Select Y when prompted.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v1.1.0 → 💼 4.10 Ensure SQL server's TDE protector is encrypted with BYOK (Use your own key)		1	1
💼 CIS Azure v1.3.0 → 💼 4.5 Ensure SQL server's TDE protector is encrypted with Customer-managed key - Level 2 (Automated)		1	1
💼 CIS Azure v1.4.0 → 💼 4.6 Ensure SQL server's TDE protector is encrypted with Customer-managed key - Level 2 (Automated)		1	1
💼 CIS Azure v1.5.0 → 💼 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key - Level 2 (Automated)		1	1
💼 CIS Azure v2.0.0 → 💼 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key - Level 2 (Automated)		1	1
💼 CIS Azure v2.1.0 → 💼 4.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key - Level 2 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 5.1.3 Ensure SQL server's Transparent Data Encryption (TDE) protector is encrypted with Customer-managed key (Automated)			1
💼 Cloudaware Framework → 💼 Data Encryption			31
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)		20	21
💼 FedRAMP High Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)	1	9	11
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1	7	17
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)		5	12
💼 FedRAMP Low Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 FedRAMP Moderate Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)	1		17
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)			12
💼 ISO/IEC 27001:2013 → 💼 A.10.1.2 Key management		9	11
💼 ISO/IEC 27001:2022 → 💼 5.33 Protection of records		10	10
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	19
💼 NIST CSF v1.1 → 💼 PR.DS-2: Data-in-transit is protected		14	21
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			82
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			69
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains		25	27
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(14) Information Flow Enforcement _ Security or Privacy Policy Filter Constraints		2	2
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest	3	15	18
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection		10	12