Control: 6.1.1.3 Ensure the storage account containing the container with activity logs is encrypted with customer-managed key (CMK)
Description
Customer-managed keys introduce additional depth to security by providing a means to manage access control for encryption keys. Where compliance and security frameworks indicate the need, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys (CMK) rather than Microsoft-managed keys.
Remediation
Remediate from Azure Portal
- Go to
Monitor. - Select
Activity log. - Select
Export Activity Logs. - Select a
Subscription. - Note the name of the
Storage Accountfor the diagnostic setting. - Navigate to
Storage accounts. - Click on the storage account.
- Under
Security + networking, clickEncryption. - Next to
Encryption type, selectCustomer-managed keys. - Complete the steps to configure a customer-managed key for encryption of the storage account.
Remediate from Azure CLI
az storage account update --name <name of the storage account> --resourcegroup <resource group for a storage account> --encryption-keysource=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> --encryption-key-name <KeyName> --encryption-key-version <Key Version>
Remediate from PowerShell
Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storageaccount name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <keyname>
Default Value
By default, encryption type is set to Microsoft-managed keys.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_6_1_1_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_6_1_1_3 --shareSQL
This control uses a named query:
select a.id as resource, case when a.encryption_key_source = 'Microsoft.Keyvault' then 'ok' else 'alarm' end as status, case when a.encryption_key_source = 'Microsoft.Keyvault' then a.name || ' container insights-activity-logs encrypted with BYOK.' else a.name || ' container insights-activity-logs not encrypted with BYOK.' end as reason , a.resource_group as resource_group , sub.display_name as subscriptionfrom azure_storage_container c, azure_storage_account a, azure_subscription subwhere c.name = 'insights-activity-logs' and c.account_name = a.name and sub.subscription_id = a.subscription_id;