| name | cis-azure-storage-5.2.3 |
| description | Ensure backup data in Recovery Services vaults is encrypted using customer-managed keys (CMK) |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","recovery-services","backup","encryption","cmk","customer-managed-keys","key-vault"] |
| cis_id | 5.2.3 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.2.3 Ensure backup data in Recovery Services vaults is encrypted using customer-managed keys (CMK) (Automated)
Description
Recovery Services vaults offer two encryption options: Microsoft-managed keys, which provide automatic encryption without user intervention, and customer-managed keys (CMK), which allow organizations to retain full control over their encryption keys for enhanced security and compliance.
Rationale
Using customer-managed keys (CMKs) to encrypt Recovery Services vaults enhances security by granting organizations complete control over their encryption keys.
Impact
There are costs and configuration overhead associated with setting up and managing customer-managed keys.
Audit Procedure
Audit from Azure Portal
- Go to
Recovery Services vaults.
- Click the name of a Recovery Services vault.
- Under
Settings, click Properties.
- Under
Encryption Settings, click Update.
- Ensure the box next to
Use your own key is checked, and a key URI is displayed under Encryption key.
- Repeat steps 1-5 for each Recovery Services vault.
Audit from Azure CLI
Run the following command to list Recovery Services vaults:
az backup vault list
For each Recovery Services vault, run the following command:
az backup vault encryption show --resource-group <resource-group> --name <recovery-services-vault>
Ensure that under properties, encryptionAtRestType is set to CustomerManaged, and a key keyUri exists with the value set to a customer-managed key URI.
Audit from PowerShell
Run the following command to list Recovery Services vaults:
Get-AzRecoveryServicesVault
Run the following command to get the Recovery Services vault in a resource group with a given name:
$vault = Get-AzRecoveryServicesVault -ResourceGroupName <resource-group> -Name <recovery-services-vault>
Run the following command to get the encryption setting for the Recovery Services vault:
$vault.Properties.EncryptionProperty.KeyVaultProperties
Ensure that the command returns a customer-managed key URI.
Repeat for each Recovery Services vault.
