Control: Azure Data Explorer encryption at rest should use a customer-managed key

Description

Enabling encryption at rest using a customer-managed key on your Azure Data Explorer cluster provides additional control over the key being used by the encryption at rest. This feature is oftentimes applicable to customers with special compliance requirements and requires a Key Vault to managing the keys.

Usage

Run the control in your terminal:

powerpipe control run terraform_azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk --share

SQL

This control uses a named query:

with kusto_clusters as (
  select
    *
  from
    terraform_resource
  where
    type = 'azurerm_kusto_cluster'
), kusto_cluster_customer_managed_key as (
  select
    split_part((attributes_std ->> 'cluster_id'), '.', 2) as cluster_name
  from
    terraform_resource
  where
    type = 'azurerm_kusto_cluster_customer_managed_key'
    and (attributes_std ->> 'key_vault_id') is not null
    and (attributes_std ->> 'key_name') is not null
    and (attributes_std ->> 'key_version') is not null
)
select
  address as resource,
  case
    when s.cluster_name is null then 'alarm'
    else 'ok'
  end as status,
  split_part(a.address, '.', 2) || case
    when s.cluster_name is null then  ' logging disabled'
    else ' logging enabled'
  end || '.' reason
  
  , a.path || ':' || a.start_line
from
  kusto_clusters as a
  left join kusto_cluster_customer_managed_key as s on a.name = s.cluster_name;

Control: Azure Data Explorer encryption at rest should use a customer-managed key

Description

Usage

SQL

Tags