Virtual machine scale sets do not have encryption at host enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_97
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk.

How to Fix

Resource: azurerm_windows_virtual_machine_scale_set

• Arguments: encryption_at_host_enabled [source,go]

---

resource "azurerm_windows_virtual_machine_scale_set" "example" { ...

• encryption_at_host_enabled = true ... }

---