| name | cis-azure-storage-5.1.3 |
| description | Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK) |
| category | cis-azure-storage |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","storage","backup","backup-vaults","encryption","cmk"] |
| cis_id | 5.1.3 |
| cis_benchmark | CIS Microsoft Azure Storage Services Benchmark v1.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
5.1.3 Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK) (Automated)
Description
Backup vaults offer two encryption options: Microsoft-managed keys, which provide automatic encryption without user intervention, and customer-managed keys (CMK), which allow organizations to retain full control over their encryption keys for enhanced security and compliance.
Rationale
Using customer-managed keys (CMKs) to encrypt Backup vaults enhances security by granting organizations complete control over their encryption keys.
Impact
There are costs and configuration overhead associated with setting up and managing customer-managed keys.
Audit Procedure
Audit from Azure Portal
- Go to
Backup vaults.
- Click the name of a Backup vault.
- Under
Manage, click Properties.
- Ensure
Encryption Settings is set to Using 'Customer-managed keys'.
- Repeat steps 1-4 for each Backup vault.
Audit from Azure CLI
Run the following command to list Backup vaults:
az dataprotection backup-vault list
For each Backup vault, run the following command:
az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>
Ensure that under properties > securitySettings > encryptionSettings > keyVaultProperties, a key keyUri exists with the value set to a customer-managed key URI.
Audit from Azure Policy
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.
If referencing a printed copy, you can search Policy IDs from this URL:
https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions
- Policy ID:
d6588149-9f06-462c-a076-56aece45b5ba
- Name: '[Preview]: Azure Backup Vaults should use customer-managed keys for encrypting backup data. Also an option to enforce Infra Encryption.'
Expected Result
Encryption Settings should show Using 'Customer-managed keys' in the Azure Portal, or properties.securitySettings.encryptionSettings.keyVaultProperties.keyUri should contain a customer-managed key URI in CLI output.
