cis-azure-foundations-6.1.1.3

Ensure the storage account containing the container with activity logs is encrypted with customer-managed key (CMK)

Description

Customer-managed keys introduce additional depth to security by providing a means to manage access control for encryption keys. Where compliance and security frameworks indicate the need, and organizational capacity allows, sensitive data at rest can be encrypted using customer-managed keys (CMK) rather than Microsoft-managed keys.

Rationale

By default in Azure, data at rest tends to be encrypted using Microsoft-managed keys. If your organization wants to control and manage encryption keys for compliance and defense-in-depth, customer-managed keys can be established.

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Impact

If the key expires due to setting the 'activation date' and 'expiration date', the key must be rotated manually. Using customer-managed keys may also incur additional man-hour requirements to create, store, manage, and protect the keys as needed.

Audit Procedure

Using Azure Portal

1. Go to Monitor.
2. Select Activity log.
3. Select Export Activity Logs.
4. Select a Subscription.
5. Note the name of the Storage Account for the diagnostic setting.
6. Navigate to Storage accounts.
7. Click on the storage account name noted in Step 5.
8. Under Security + networking, click Encryption.
9. Ensure Customer-managed keys is selected and a key is set.

Using Azure CLI

1. Get storage account id configured with log profile:

az monitor diagnostic-settings subscription list --subscription <subscription id> --query 'value[*].storageAccountId'

2. Ensure the storage account is encrypted with CMK:

az storage account list --query "[?name=='<Storage Account Name>']"

In command output ensure keySource is set to Microsoft.Keyvault and keyVaultProperties is not set to null.

Using PowerShell

Get-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name>|select-object -ExpandProperty encryption|format-list

Ensure the value of KeyVaultProperties is not null or empty, and ensure KeySource is not set to Microsoft.Storage.

Expected Result

The storage account containing activity logs should use Customer-managed keys (CMK) for encryption, with keySource set to Microsoft.Keyvault.

Remediation

Remediate from Azure Portal

1. Go to Monitor.
2. Select Activity log.
3. Select Export Activity Logs.
4. Select a Subscription.
5. Note the name of the Storage Account for the diagnostic setting.
6. Navigate to Storage accounts.
7. Click on the storage account.
8. Under Security + networking, click Encryption.
9. Next to Encryption type, select Customer-managed keys.
10. Complete the steps to configure a customer-managed key for encryption of the storage account.

Remediate from Azure CLI

az storage account update --name <name of the storage account> --resource-group <resource group for a storage account> --encryption-key-source=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> --encryption-key-name <KeyName> --encryption-key-version <Key Version>

Remediate from PowerShell

Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <key name>

Default Value

By default, encryption type is set to Microsoft-managed keys.

References

1. https://learn.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices#protect-data-at-rest
2. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required
3. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=cli#managing-legacy-log-profiles

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 2 | Manual