| name | cis-azure-storage-15.2 |
| description | Ensure customer-managed keys (CMK) are used to encrypt data at rest on Azure Elastic SAN volume groups |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","elastic-san","encryption","cmk"] |
| cis_id | 15.2 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
15.2 Ensure customer-managed keys (CMK) are used to encrypt data at rest on Azure Elastic SAN volume groups (Automated)
Description
Azure Elastic SAN volume groups offer two encryption options: Microsoft-managed keys, which provide automatic encryption without user intervention, and customer-managed keys (CMK), which allow organizations to retain full control over their encryption keys for enhanced security and compliance.
Rationale
Using customer-managed keys (CMKs) to encrypt Azure Elastic SAN volume groups enhances security by granting organizations complete control over their encryption keys.
Impact
There are costs and configuration overhead associated with setting up and managing customer-managed keys.
Audit Procedure
Audit from Azure Portal
- Go to
Elastic SANs.
- Click the name of an Elastic SAN.
- Under
SAN Management, click Volume groups.
- For each volume group, ensure that the value in the
Encryption type column is not Platform-managed key.
Audit from Azure CLI
Run the following command to list Elastic SANs:
az elastic-san list
For each Elastic SAN with a volumeGroupCount greater than 0, run the following command to list volume groups:
az elastic-san volume-group list --resource-group <resource-group> --elastic-san <elastic-san>
Ensure that for each volume group, encryption is set to EncryptionAtRestWithCustomerManagedKey.
Audit from PowerShell
Run the following command to list Elastic SANs:
Get-AzElasticSan
For each Elastic SAN with a VolumeGroupCount greater than 0, run the following command to list volume groups:
Get-AzElasticSanVolumeGroup -ResourceGroupName <resource-group> -ElasticSanName <elastic-san>
Ensure that for each volume group, Encryption is set to EncryptionAtRestWithCustomerManagedKey.
Audit from Azure Policy
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.
If referencing a printed copy, you can search Policy IDs from this URL:
https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
