cis-azure-foundations-6-1-1-3

name	cis-azure-foundations-6.1.1.3
description	Ensure storage account containing activity logs is encrypted with CMK
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","logging","monitoring","encryption","cmk","storage"]
cis_id	6.1.1.3
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-6.1.1.1"]
prerequisites	["cis-azure-foundations-6.1.1.1"]
severity_boost	{}

Ensure the storage account containing the container with activity logs is encrypted with customer-managed key (CMK)

Description

Customer-managed keys introduce additional depth to security by providing a means to manage access control for encryption keys. Where compliance and security frameworks indicate the need, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys (CMK) rather than Microsoft-managed keys.

Rationale

By default in Azure, data at rest tends to be encrypted using Microsoft-managed keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, customer-managed keys can be established.

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Impact

If the key expires due to setting the 'activation date' and 'expiration date', the key must be rotated manually. Using customer-managed keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.

Audit Procedure

Using Azure Portal

1. Go to Monitor.
2. Select Activity log.
3. Select Export Activity Logs.
4. Select a Subscription.
5. Note the name of the Storage Account for the diagnostic setting.
6. Navigate to Storage accounts.
7. Click on the storage account name noted in Step 5.
8. Under Security + networking, click Encryption.
9. Ensure Customer-managed keys is selected and a key is set.

Using Azure CLI

1. Get storage account id configured with log profile:

az monitor diagnostic-settings subscription list --subscription <subscription id> --query 'value[*].storageAccountId'

2. Ensure the storage account is encrypted with CMK:

az storage account list --query "[?name=='<Storage Account Name>']"

In command output ensure keySource is set to Microsoft.Keyvault and keyVaultProperties is not set to .