Control: Ensure that 'Unattached disks' are encrypted with 'Customer Managed Key' (CMK)

powerpipe control run azure_compliance.control.compute_unattached_disk_encrypted_with_cmk

powerpipe login
powerpipe control run azure_compliance.control.compute_unattached_disk_encrypted_with_cmk --share

select
  disk.id as resource,
  case
    when encryption_type = 'EncryptionAtRestWithCustomerKey' then 'ok'
    else 'alarm'
  end as status,
  case
    when encryption_type = 'EncryptionAtRestWithCustomerKey' then disk.name || ' encrypted with CMK.'
    else disk.name || ' not encrypted with CMK.'
  end as reason
  
  , disk.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_compute_disk disk,
  azure_subscription sub
where
  disk_state != 'Attached'
  and sub.subscription_id = disk.subscription_id;