| name | cis-azure-foundations-6.1.1.3 |
| description | Ensure storage account containing activity logs is encrypted with CMK |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","logging","monitoring","encryption","cmk","storage"] |
| cis_id | 6.1.1.3 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | ["cis-azure-foundations-6.1.1.1"] |
| prerequisites | ["cis-azure-foundations-6.1.1.1"] |
| severity_boost | {} |
Ensure the storage account containing the container with activity logs is encrypted with customer-managed key (CMK)
Description
Customer-managed keys introduce additional depth to security by providing a means to manage access control for encryption keys. Where compliance and security frameworks indicate the need, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys (CMK) rather than Microsoft-managed keys.
Rationale
By default in Azure, data at rest tends to be encrypted using Microsoft-managed keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, customer-managed keys can be established.
Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.
Impact
If the key expires due to setting the 'activation date' and 'expiration date', the key must be rotated manually. Using customer-managed keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.
Audit Procedure
Using Azure Portal
- Go to
Monitor.
- Select
Activity log.
- Select
Export Activity Logs.
- Select a
Subscription.
- Note the name of the
Storage Account for the diagnostic setting.
- Navigate to
Storage accounts.
- Click on the storage account name noted in Step 5.
- Under
Security + networking, click Encryption.
- Ensure
Customer-managed keys is selected and a key is set.
Using Azure CLI
- Get storage account id configured with log profile:
az monitor diagnostic-settings subscription list --subscription <subscription id> --query 'value[*].storageAccountId'
- Ensure the storage account is encrypted with CMK:
az storage account list --query "[?name=='<Storage Account Name>']"
In command output ensure keySource is set to Microsoft.Keyvault and keyVaultProperties is not set to .
