cis-azure-compute-15-2

name	cis-azure-compute-15.2
description	Ensure Batch pools disk encryption is set enabled
category	cis-azure-compute
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","batch"]
cis_id	15.2
cis_benchmark	CIS Microsoft Azure Compute Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure Batch pools disk encryption is set enabled

Description

Azure Batch pools must have disk encryption enabled to protect data at rest on both OS and temporary disks, using Azure-managed encryption keys by default.

Rationale

Enabling disk encryption meets compliance requirements, follows security best practices, and safeguards against unauthorized access to cached data and task outputs stored on VM disks.

Impact

This ensures automatic encryption with minimal performance impact, though it requires pool recreation and is unsupported on Basic A-series VMs.

Audit Procedure

Using Azure Portal

1. Login to Azure portal https://portal.azure.com
2. Navigate to Batch Accounts

For each Batch account perform the following:

1. Expand the Features section then click on Pools
2. For each Pool ID, click the name to open the pool
3. Under the Configuration section, check Disk Encryption

If the pool is encrypted, it should display "OS disk" and/or "Temporary disk" encryption enabled.

Using Azure CLI

Run the following commands:

# List all pools and their encryption status
az batch pool list \
    --account-name <batch-account-name> \
    --query "[].{id:id, encryption:deploymentConfiguration.virtualMachineConfiguration.diskEncryptionConfiguration}" \
    --output table

Expected Output: "OsDisk" and/or "TemporaryDisk" should be listed under encryption.targets.

Using Azure PowerShell

Run the following command:

# Get Batch account context
$batchContext = Get-AzBatchAccount -AccountName "<batch-account-name>"

# List all pools and check encryption
Get-AzBatchPool -BatchContext $batchContext | ForEach-Object {
    $pool = $_
    $encryptionConfig = $pool.DeploymentConfiguration.VirtualMachineConfiguration.DiskEncryptionConfiguration
    [PSCustomObject]@{
        PoolId = $pool.Id
        OsDiskEncrypted = $encryptionConfig.Targets -contains "OsDisk"
        TempDiskEncrypted = $encryptionConfig.Targets -contains "TemporaryDisk"
    }
}

Expected Output: OsDiskEncrypted and TempDiskEncrypted should be True.

Expected Result

All Batch pools should have disk encryption enabled with "OsDisk" and/or "TemporaryDisk" listed as encryption targets.