cis-azure-storage-10-1

name	cis-azure-storage-10.1
description	Ensure 'Encryption key source' is set to 'Customer Managed Key' for Azure NetApp Files accounts
category	cis-azure-storage
version	1.0.0
author	cyberstrike-official
tags	["cis","azure","storage","netapp","encryption","cmk"]
cis_id	10.1
cis_benchmark	CIS Microsoft Azure Storage Services Benchmark v1.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

10.1 Ensure 'Encryption key source' is set to 'Customer Managed Key' for Azure NetApp Files accounts (Automated)

Description

Customer-managed keys (CMK) for Azure NetApp Files volume encryption enable organizations to use their own keys instead of platform-managed ones, providing full control over encryption.

Rationale

Using customer-managed keys (CMKs) to encrypt Azure NetApp Files volumes enhances security by granting organizations complete control over their encryption keys.

Impact

There are costs and configuration overhead associated with setting up and managing customer-managed keys.

Audit Procedure

Audit from Azure Portal

1. Go to Azure NetApp Files.
2. Click the name of a NetApp account.
3. Under Azure NetApp Files, click Encryption.
4. Ensure that Encryption key source is set to Customer Managed Key.
5. Repeat steps 1-4 for each NetApp Files account.

Audit from Azure CLI

Run the following command to list NetApp Files accounts:

az netappfiles account list

For each NetApp Files account, run the following command:

az netappfiles account show --resource-group <resource-group> --account-name <netapp-files-account>

Ensure that under encryption, keySource is set to Microsoft.KeyVault.

Audit from PowerShell

Run the following command to install the Az.NetAppFiles module:

Install-Module Az.NetAppFiles

Enter Y when prompted.

Run the following command to list NetApp Files accounts:

Get-AzResource | ? {$_.ResourceType -like 'Microsoft.NetApp/netAppAccounts'} | Format-Table

Run the following command to get the NetApp Files account in a resource group with a given name:

$netapp = Get-AzNetAppFilesAccount -ResourceGroupName <resource-group> -Name <netapp-files-account>

Run the following command to get the encryption key source for the NetApp Files account:

$netapp.Encryption.KeySource

Ensure that the command returns Microsoft.KeyVault. Repeat for each NetApp Files account.