turbot/ibm_compliance

Control: 2.2.1.2 Ensure Block Storage is encrypted with BYOK

Description

By default, IBM Cloud Block Storage provides provider-managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Service – Key Protect . The customer can chose to use BYOK instead of provider-managed keys for enhanced security.

Remediation

You will not be able to change encryption option once data is already written to a Cloud Block Storage Volume. In order to ensure that objects are encrypted using customer managed keys you will need to create a new Cloud Block Storage volume, set it to use either Key Protect or Hyper Protect key management service and then upload/copy the existing objects to this new volume.

Usage

Run the control in your terminal:

powerpipe control run ibm_compliance.control.cis_v100_2_2_1_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run ibm_compliance.control.cis_v100_2_2_1_2 --share

SQL

This control uses a named query:

manual_control

Tags