cis-azure-compute-15.2

Ensure Batch pools disk encryption is set enabled

Description

Azure Batch pools must have disk encryption enabled to protect data at rest on both OS and temporary disks, using Azure-managed encryption keys by default.

Rationale

Enabling disk encryption meets compliance requirements, follows security best practices, and safeguards against unauthorized access to cached data and task outputs stored on VM disks.

Impact

This ensures automatic encryption with minimal performance impact, though it requires pool recreation and is unsupported on Basic A-series VMs.

Audit Procedure

Using Azure Portal

1. Login to Azure portal https://portal.azure.com
2. Navigate to Batch Accounts

For each Batch account perform the following:

1. Expand the Features section then click on Pools
2. For each Pool ID, click the name to open the pool
3. Under the Configuration section, check Disk Encryption

If the pool is encrypted, it should display "OS disk" and/or "Temporary disk" encryption enabled.

Using Azure CLI

Run the following commands:

# List all pools and their encryption status
az batch pool list \
    --account-name <batch-account-name> \
    --query "[].{id:id, encryption:deploymentConfiguration.virtualMachineConfiguration.diskEncryptionConfiguration}" \
    --output table

Expected Output: "OsDisk" and/or "TemporaryDisk" should be listed under encryption.targets.

Using Azure PowerShell

Run the following command:

# Get Batch account context
$batchContext = Get-AzBatchAccount -AccountName "<batch-account-name>"

# List all pools and check encryption
Get-AzBatchPool -BatchContext $batchContext | ForEach-Object {
    $pool = $_
    $encryptionConfig = $pool.DeploymentConfiguration.VirtualMachineConfiguration.DiskEncryptionConfiguration
    [PSCustomObject]@{
        PoolId = $pool.Id
        OsDiskEncrypted = $encryptionConfig.Targets -contains "OsDisk"
        TempDiskEncrypted = $encryptionConfig.Targets -contains "TemporaryDisk"
    }
}

Expected Output: OsDiskEncrypted and TempDiskEncrypted should be True.

Expected Result

All Batch pools should have disk encryption enabled with "OsDisk" and/or "TemporaryDisk" listed as encryption targets.

Remediation

NOTE: Encrypted pools must be created as replacements for unencrypted pools. Please ensure that necessary precautions are taken to backup and restore data from persistent disk pools.

Using Azure Portal

1. Navigate to Azure Batch accounts
2. Select your Batch account
3. Click Pools in the left menu
4. For each unencrypted pool, click Create new pool
5. Under Advanced settings, enable Disk encryption and select OS disk or All disks
6. Configure all other settings to match your existing pool
7. Click Create to deploy the encrypted pool
8. Resize the old unencrypted pool to 0 nodes after verifying the new pool is operational

Repeat steps 4-8 for each unencrypted pool.

Using Azure CLI

1. Get pool configuration:

config=$(az batch pool show --pool-id <pool-name> --query "{vmSize:vmSize,image:virtualMachineConfiguration.imageReference,nodeCount:targetDedicatedNodes}")

2. Create encrypted replacement:

az batch pool create \
    --id "<pool-name>-encrypted" \
    --vm-size $(jq -r '.vmSize' <<< "$config") \
    --image-reference "$(jq -r '.image.publisher + ":" + .image.offer + ":" + .image.sku + ":" + .image.version' <<< "$config")" \
    --node-count $(jq -r '.nodeCount' <<< "$config") \
    --disk-encryption-target OsDisk

3. Decommission old pool:

az batch pool resize --pool-id <pool-name> --target-dedicated-nodes 0

Using Azure PowerShell

1. Get pool configuration:

$pool = Get-AzBatchPool -Id "<pool-name>" -BatchContext $context

2. Create encrypted replacement:

$newConfig = New-Object Microsoft.Azure.Commands.Batch.Models.PSPoolConfiguration
$newConfig.VirtualMachineConfiguration = $pool.VirtualMachineConfiguration.Clone()
$newConfig.VirtualMachineConfiguration.DiskEncryptionConfiguration = New-Object Microsoft.Azure.Commands.Batch.Models.PSDiskEncryptionConfiguration
$newConfig.VirtualMachineConfiguration.DiskEncryptionConfiguration.Targets = "OsDisk"
New-AzBatchPool -Id "<pool-name>-encrypted" -PoolConfiguration $newConfig -BatchContext $context

3. Decommission old pool:

Set-AzBatchPool -Id "<pool-name>" -TargetDedicatedComputeNodes 0 -BatchContext $context

Default Value

Disk encryption is disabled by default for new Azure Batch pools.

References

1. https://docs.microsoft.com/en-us/azure/batch/disk-encryption
2. https://docs.microsoft.com/en-us/cli/azure/batch/pool#az-batch-pool-create

Profile

Level 1 | Automated