メニュー
Ensure Batch account is set to use customer-managed keys to encrypt data
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-compute-15-1コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | cis-azure-compute-15.1 |
| description | Ensure Batch account is set to use customer-managed keys to encrypt data |
| category | cis-azure-compute |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","batch"] |
| cis_id | 15.1 |
| cis_benchmark | CIS Microsoft Azure Compute Services Benchmark v2.0.0 |
| tech_stack |
| ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Customer-managed keys introduce additional depth to security by providing a means to manage access control for encryption keys. Where compliance and security frameworks indicate the need, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys (CMK) rather than Microsoft-managed keys.
While it is possible to automate the assessment of this recommendation, the assessment status for this recommendation remains 'Manual' due to ideally limited scope. The scope of application -- which workloads CMK is applied to -- should be carefully considered to account for organizational capacity and targeted to workloads with specific need for CMK.
By default in Azure, data at rest tends to be encrypted using Microsoft-managed keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, customer-managed keys can be established.
If the key expires due to setting the 'activation date' and 'expiration date', the key must be rotated manually.
Using customer-managed keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.
Batch accountsFor each Batch account perform the following:
Settings section, click on EncryptionCustomer-managed key radio button is selectedIf no key vault key is set, the configuration fails this audit procedure.
The following command should return the Key URL and source Key Vault:
az batch account show --name <batch-account-name> --resource-group <resource-group-name> --query "keyVaultReference"
If the result is null or Empty, the configuration fails this audit procedure.
Set-AzBatchAccount -ResourceGroupName <resource_group_name> -AccountName <batch_account_name> `
-KeyVaultReferenceId "/subscriptions/<subscription_ID>/resourceGroups/<resource_group_name>/providers/Microsoft.KeyVault/vaults/<keyvault_name>" `
-KeyVaultReferenceUrl "https://<keyvault_name>.vault.azure.net/keys/<key_name>"
The Batch account should have Customer-managed key encryption selected with a valid key vault key configured. The keyVaultReference should not be null or empty.
Batch accountsFor each Batch account:
Settings section, click on EncryptionCustomer-managed key radio buttonEnter key URI or Select from key vault to select and set the encryption key.# Link CMK to Batch account
az batch account set \
--resource-group <resource_group_name> \
--name <batch_account_name> \
--encryption-key-identifier https://<keyvault_name>.vault.azure.net/keys/<key_name>/<Version>
Set-AzBatchAccount -ResourceGroupName <resource_group_name> -AccountName <batch_account_name> `
-KeyVaultReferenceId "/subscriptions/<subscription_ID>/resourceGroups/<resource_group_name>/providers/Microsoft.KeyVault/vaults/<keyvault_name>" `
-KeyVaultReferenceUrl "https://<keyvault_name>.vault.azure.net/keys/<key_name>"
Azure Batch accounts uses Microsoft-managed keys (service-managed encryption) for data at rest by default.
Level 2 | Manual