📝 Azure Unattached Managed Disk is not encrypted with Customer-managed key 🟢
- Contextual name: 📝 Unattached Managed Disk is not encrypted with Customer-managed key 🟢
- ID:
/ce/ca/azure/virtual-machine/unattached-disk-encryption-with-cmk - Located in: 📁 Azure Virtual Machine
Flags
Our Metadata
- Policy Type:
COMPLIANCE_POLICY - Policy Category:
SECURITY
Similar Policies
- Cloud Conformity
- Internal
dec-x-f63fd4f0
Similar Internal Rules
| Rule | Policies | Flags |
|---|---|---|
| ✉️ dec-x-f63fd4f0 | 1 |
Logic
- 🧠 prod.logic.yaml 🟢
Description
Description
Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).
Rationale
Managed disks are encrypted by default with Platform-managed keys. Using Customer-managed keys may provide an additional level of security or meet an organization's regulatory requirements. Encrypting managed disks ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks, which may lead to sensitive information disclosure and tampering.
Impact
NOTE: You must have your key vault set up to utilize this. Encryption is available only on Standard tier VMs. This might cost you more.
Utilizing and maintaining Customer-managed keys will require additional work to create, protect, and rotate keys.
Audit
From Azure Portal
- Go to
Disks.- Click on
Add Filter.... see more
Remediation
Remediation
If data stored in the disk is no longer useful, refer to Azure documentation to delete unattached data disks at:
- https://docs.microsoft.com/en-us/rest/api/compute/disks/delete
- https://docs.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-delete
If data stored in the disk is important, To encrypt the disk refer azure documentation at: