| name | cis-azure-storage-4.1 |
| description | Ensure 'Key encryption key' is set to a customer-managed key for Azure Managed Lustre file systems |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","managed-lustre","encryption","cmk"] |
| cis_id | 4.1 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
4.1 Ensure 'Key encryption key' is set to a customer-managed key for Azure Managed Lustre file systems (Automated)
Description
Enable customer-managed encryption keys (CMEK) for Azure Managed Lustre file systems to enhance data security and provide greater control over encryption processes. By using CMEK, organizations can manage their own encryption keys within Azure Key Vault, allowing them to rotate, revoke, or otherwise control access to these keys in accordance with their security policies.
Rationale
Using customer-managed encryption keys (CMEK) gives organizations complete control over encryption keys, ensuring compliance and enhancing data security. CMEK allows for key rotation, revocation, and lifecycle management, thus improving data protection and facilitating immediate control over data access in Azure Managed Lustre file systems.
Impact
There are costs and configuration overhead associated with setting up and managing customer-managed keys.
Audit Procedure
Audit from Azure Portal
- Go to
Azure Managed Lustre.
- Click the name of a file system.
- Under
Settings, click Properties.
- Under
Encryption settings, ensure that the value next to Key encryption key is View value as JSON.
- Repeat steps 1-4 for each file system.
Audit from Azure CLI
Run the following command to list Azure Managed Lustre file systems:
az amlfs list
For each file system, run the following command:
az amlfs show --resource-group <resource-group> --name <file-system>
Ensure that under encryptionSettings > keyEncryptionKey, keyUrl is set to a customer-managed key URL.
Audit from PowerShell
Run the following command to install the Az.StorageCache module:
Install-Module Az.StorageCache
Enter Y when prompted.
Run the following command to list Azure Managed Lustre file systems:
Get-AzStorageCacheAmlFileSystem
Run the following command to get the file system in a resource group with a given name:
$filesystem = Get-AzStorageCacheAmlFileSystem -ResourceGroupName <resource-group> -Name <file-system>
