Azure Databricks Workspaces not using customer-managed key for root DBFS encryption misconfiguration

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_48
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

This rule checks whether Databricks Workspaces leverage a customer-managed key for root DBFS encryption. DBFS (Databricks File System) is the distributed file system used by Databricks clusters. Encrypting the root DBFS adds an extra layer of security, ensuring that even in the event of unauthorized access, the data remains inaccessible and secure. Customer-managed keys enhance security by giving you control over encryption, strengthening your security posture.

How to Fix

Resource: Microsoft.Databricks/workspaces

• Arguments: prepareEncryption/value

Set the customer_managed_key_enabled attribute to true during Azure Databricks workspace creation. This enables customer-managed key encryption for your DBFS root data at rest. [source,go]

"resources": [ { "type": "Microsoft.Databricks/workspaces", "properties": { ... "parameters": { "prepareEncryption": {

•      "value": true
    },

•    "encryption": {

•      "value": {

•        ...

•      }
    },
  }

  } } ]

---