turbot/steampipe-mod-azure-compliance

Query: compute_disk_unattached_encrypted_with_cmk

Usage

powerpipe query azure_compliance.query.compute_disk_unattached_encrypted_with_cmk

SQL

select
disk.id as resource,
case
when managed_by is not null
or managed_by != ''
or encryption_type = 'EncryptionAtRestWithCustomerKey'
or encryption_type = 'EncryptionAtRestWithPlatformAndCustomerKeys'
then 'ok'
else 'alarm'
end as status,
case
when managed_by is not null
or managed_by != ''
or encryption_type = 'EncryptionAtRestWithCustomerKey'
or encryption_type = 'EncryptionAtRestWithPlatformAndCustomerKeys'
then disk.name || ' attached and encrypted with ADE/CMK.'
else disk.name || ' unattached and encrypted with default encryption key.'
end as reason
, disk.resource_group as resource_group
, sub.display_name as subscription
from
azure_compute_disk disk
left join azure_subscription as sub on sub.subscription_id = disk.subscription_id
where
disk_state != 'Attached';

Controls

The query is being used by the following controls: