Control: Virtual machines and virtual machine scale sets should have encryption at host enabled

Description

Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk.

Usage

Run the control in your terminal:

powerpipe control run terraform_azure_compliance.control.compute_vm_and_scale_set_encryption_at_host_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_azure_compliance.control.compute_vm_and_scale_set_encryption_at_host_enabled --share

SQL

This control uses a named query:

(
select
  address as resource,
  case
    when (attributes_std -> 'encryption_at_host_enabled') is null then 'alarm'
    when (attributes_std -> 'encryption_at_host_enabled')::boolean then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'encryption_at_host_enabled') is null then ' ''encryption_at_host_enabled'' is not defined'
    when (attributes_std -> 'encryption_at_host_enabled')::boolean then ' encryption at host enabled'
    else ' encryption at host disabled'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'azurerm_linux_virtual_machine_scale_set' or
  type = 'azurerm_windows_virtual_machine_scale_set'
)
union
(
select
  address as resource,
  case
    when (attributes_std -> 'encryption_at_host_enabled') is null then 'alarm'
    when (attributes_std -> 'encryption_at_host_enabled')::boolean then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std -> 'encryption_at_host_enabled') is null then ' ''encryption_at_host_enabled'' is not defined'
    when (attributes_std -> 'encryption_at_host_enabled')::boolean then ' encryption at host enabled'
    else ' encryption at host disabled'
  end || '.' reason
  
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'azurerm_windows_virtual_machine' or
  type = 'azurerm_linux_virtual_machine'
)

Control: Virtual machines and virtual machine scale sets should have encryption at host enabled

Description

Usage

SQL

Tags