Azure VM data disk is not encrypted with ADE/CMK misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_2
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Azure encrypts data disks by default Server-Side Encryption (SSE) with platform-managed keys [SSE with PMK]. It is recommended to use either SSE with Azure Disk Encryption [SSE with PMK+ADE] or Customer Managed Key [SSE with CMK] which improves on platform-managed keys by giving you control of the encryption keys to meet your compliance needs. Encryption does not impact the performance of managed disks and there is no additional cost for the encryption.

How to Fix

Resource: encryptionOperation

• Arguments: EnableEncryption [source,go]

---

{ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "vmName": { "type": "string", "metadata": { "description": "Name of the virtual machine" } }, "volumeType": { "type": "string", "defaultValue": "Data", "allowedValues": [ "Data" ], "metadata": { "description": "Decryption is supported only on data drives for Linux VMs." } }, "sequenceVersion": { "type": "string", "defaultValue": "1.0", "metadata": { "description": "Pass in an unique value like a GUID everytime the operation needs to be force run" } }, "location": { "type": "string", "defaultValue": "[resourceGroup().location]", "metadata": { "description": "Location for all resources." } } }, "variables": { "extensionName": "AzureDiskEncryptionForLinux", "extensionVersion": "0.1",

• "encryptionOperation": "EnableEncryption",

...