rules/findings/azure/azure_batch/azure-batch-account-lacks-cmk.json
|
{
"provider": "Azure", "serviceType": "Batch", "serviceName": "Batch", "displayName": "Ensure Batch account is set to use customer-managed keys to encrypt data", "description": "Customer-managed keys introduce additional depth to security by providing a means to manage access control for encryption keys. Where compliance and security frameworks indicate the need, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys (CMK) rather than Microsoft-managed keys.", "rationale": "By default in Azure, data at rest tends to be encrypted using Microsoft-managed keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, customer-managed keys can be established.\u003Cbr/\u003E\u003Cbr/\u003EWhile it is possible to automate the assessment of this recommendation, the assessment status for this recommendation remains \u0027Manual\u0027 due to ideally limited scope. The scope of application\u2014which workloads CMK is applied to\u2014should be carefully considered to account for organizational capacity and targeted to workloads with specific need for CMK.", "impact": "If the key expires due to setting the \u0027activation date\u0027 and \u0027expiration date\u0027, the key must be rotated manually.\u003Cbr/\u003E\u003Cbr/\u003EUsing customer-managed keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.", "remediation": { "text": "Remediate from Azure Portal 1. Login to Azure Portal using https://portal.azure.com 2. Navigate to Batch accounts For each Batch account 1. Under the Settings section, click on Encryption 2. Select the Customer-managed key radio button 3. Use either Enter key URI or Select from key vault to select and set the encryption key.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/batch/batch-customer-managed-key" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "2.0.0", "reference": "15.1", "profile": [ "Level 2" ] } ], "level": "medium", "tags": [], "rule": { "path": "", "subPath": null, "selectCondition": {}, "query": [], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure Batch account is set to use customer-managed keys to encrypt data", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "azure_batch_account_lacks_cmk", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "azure_batch_001" } |