Control: Azure Data Explorer encryption at rest should use a customer-managed key

Description

Enabling encryption at rest using a customer-managed key on your Azure Data Explorer cluster provides additional control over the key being used by the encryption at rest. This feature is oftentimes applicable to customers with special compliance requirements and requires a Key Vault to managing the keys.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk --share

SQL

This control uses a named query:

select
  kv.id as resource,
  case
    when
      key_vault_properties -> 'keyName' is not null
      and key_vault_properties -> 'keyVaultUri' is not null
      and key_vault_properties -> 'keyVersion' is not null
    then 'ok'
    else 'alarm'
  end as status,
  case
    when
      key_vault_properties -> 'keyName' is not null
      and key_vault_properties -> 'keyVaultUri' is not null
      and key_vault_properties -> 'keyVersion' is not null
    then name || ' encrypted at rest with CMK.'
    else name || ' not encrypted at rest with CMK.'
  end as reason
  
  , kv.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_kusto_cluster as kv,
  azure_subscription as sub
where
  sub.subscription_id = kv.subscription_id;

Control: Azure Data Explorer encryption at rest should use a customer-managed key

Description

Usage

SQL

Tags