Azure Data Explorer encryption at rest does not use a customer-managed key misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_11
Category - Subcategory	Storage - Encryption
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

Enabling encryption at rest using a customer-managed key on your Azure Data Explorer cluster provides additional control over the key being used by the encryption at rest. This feature is often applicable to customers with special compliance requirements and requires a Key Vault to managing the keys.

How to Fix

Resource: azurerm_kusto_cluster, azurerm_kusto_cluster_customer_managed_key

• Arguments: cluster_id (of azurerm_kusto_cluster_customer_managed_key ) [source,go]

---

{ "resource "azurerm_kusto_cluster" "cluster_ok" { name = "kustocluster" location = azurerm_resource_group.rg.location resource_group_name = azurerm_resource_group.rg.name

sku { name = "Standard_D13_v2" capacity = 2 }

identity { type = "SystemAssigned" }

}

resource "azurerm_kusto_cluster_customer_managed_key" "example" { cluster_id = azurerm_kusto_cluster.cluster_ok.id key_vault_id = azurerm_key_vault.example.id key_name = azurerm_key_vault_key.example.name key_version = azurerm_key_vault_key.example.version }

", }