Azure Service Bus Doesn't Use Customer-Managed Key Encryption misconfiguration detected in code

Azure Service Bus Doesn't Use Customer-Managed Key Encryption misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_201
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

Azure Service Bus is a cloud messaging service used to connect applications, services, and devices running on Azure with on-premises software. It facilitates asynchronous, decoupled communication among decoupled components in the cloud, on-premises, or in a hybrid solution.

This rule ensures that the Azure Service Bus data is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. Utilizing a CMK offers enhanced control and transparency over the key lifecycle, and ensures that you, as the customer, maintain control of the encryption keys.

How to Fix

Resource:

• azurerm_servicebus_namespace

Arguments:

• customer_managed_key [source,go]

---

resource "azurerm_servicebus_namespace" "example" { name = "example-namespace"

... other configurations ...

• customer_managed_key {
• key_vault_key_id = "azure key vault key id here" }

... other configurations ...

}