Control: Storage account containing VHD OS disk not encrypted with CMK

Description

This policy identifies Azure Storage account containing VHD OS disk which are not encrypted with CMK. VHD's attached to Virtual Machines are stored in Azure storage. By default Azure Storage account is encrypted using Microsoft Managed Keys. It is recommended to use Customer Managed Keys to encrypt data in Azure Storage accounts for better control on the data.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.storage_account_containing_vhd_os_disk_cmk_encrypted

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.storage_account_containing_vhd_os_disk_cmk_encrypted --share

SQL

This control uses a named query:

select
  sa.id as resource,
  case
    when sa.encryption_key_source = 'Microsoft.Storage'
    and vm.os_disk_vhd_uri is not null then 'alarm'
    else 'ok'
  end as status,
  case
    when sa.encryption_key_source = 'Microsoft.Storage'
    and vm.os_disk_vhd_uri is not null then sa.name || ' storage account containing VHD OS disk not encrypted with CMK.'
    else sa.name || ' storage account containing VHD OS disk encrypted with CMK.'
  end as reason
  
  , sa.resource_group as resource_group
  , vm.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_storage_account sa,
  azure_compute_virtual_machine vm,
  azure_subscription sub
where
  sub.subscription_id = sa.subscription_id
  and vm.os_disk_vhd_uri like '%' || sa.name || '%';

Control: Storage account containing VHD OS disk not encrypted with CMK

Description

Usage

SQL

Tags