Control: 5.1.3 Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key

Description

Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Remediation

From Azure Portal

Navigate to the Storage accounts blade.
Click on the storage account.
Under Security + networking, click Encryption.
Next to Encryption type, select Customer-managed keys.
Complete the steps to configure a customer-managed key for encryption of the storage account.

From Azure CLI

az storage account update --name <name of the storage account> --resource-group <resource group for a storage account> --encryption-key-source=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> --encryption-key-name <KeyName> --encryption-key-version <Key Version>

From PowerShell

Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <keyname>

Default Value

By default, for a storage account keySource is set to Microsoft.Storage allowing encryption with vendor Managed key and not a Customer Managed Key.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.cis_v210_5_1_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.cis_v210_5_1_3 --share

SQL

This control uses a named query:

select
  a.id as resource,
  case
    when a.encryption_key_source = 'Microsoft.Keyvault' then 'ok'
    else 'alarm'
  end as status,
  case
    when a.encryption_key_source = 'Microsoft.Keyvault'
      then a.name || ' container insights-activity-logs encrypted with BYOK.'
    else a.name || ' container insights-activity-logs not encrypted with BYOK.'
  end as reason
  
  , a.resource_group as resource_group
  , sub.display_name as subscription
from
  azure_storage_container c,
  azure_storage_account a,
  azure_subscription sub
where
  c.name = 'insights-activity-logs'
  and c.account_name = a.name
  and sub.subscription_id = a.subscription_id;