cis-azure-storage-15.2

15.2 Ensure customer-managed keys (CMK) are used to encrypt data at rest on Azure Elastic SAN volume groups (Automated)

Description

Azure Elastic SAN volume groups offer two encryption options: Microsoft-managed keys, which provide automatic encryption without user intervention, and customer-managed keys (CMK), which allow organizations to retain full control over their encryption keys for enhanced security and compliance.

Rationale

Using customer-managed keys (CMKs) to encrypt Azure Elastic SAN volume groups enhances security by granting organizations complete control over their encryption keys.

Impact

There are costs and configuration overhead associated with setting up and managing customer-managed keys.

Audit Procedure

Audit from Azure Portal

1. Go to Elastic SANs.
2. Click the name of an Elastic SAN.
3. Under SAN Management, click Volume groups.
4. For each volume group, ensure that the value in the Encryption type column is not Platform-managed key.

Audit from Azure CLI

Run the following command to list Elastic SANs:

az elastic-san list

For each Elastic SAN with a volumeGroupCount greater than 0, run the following command to list volume groups:

az elastic-san volume-group list --resource-group <resource-group> --elastic-san <elastic-san>

Ensure that for each volume group, encryption is set to EncryptionAtRestWithCustomerManagedKey.

Audit from PowerShell

Run the following command to list Elastic SANs:

Get-AzElasticSan

For each Elastic SAN with a VolumeGroupCount greater than 0, run the following command to list volume groups:

Get-AzElasticSanVolumeGroup -ResourceGroupName <resource-group> -ElasticSanName <elastic-san>

Ensure that for each volume group, Encryption is set to EncryptionAtRestWithCustomerManagedKey.

Audit from Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

• Policy ID: 7698f4ed-80ce-4e13-b408-ee135fa400a5
• Name: 'ElasticSan Volume Group should use customer-managed keys to encrypt data at rest'

Expected Result

For each volume group in every Elastic SAN, the encryption (CLI) or Encryption (PowerShell) property should be set to EncryptionAtRestWithCustomerManagedKey. In the Azure Portal, the Encryption type column should not show Platform-managed key.

Remediation

Remediate from Azure Portal

It is not currently possible to remediate from Azure Portal. Refer to the Remediate from Azure CLI and Remediate from PowerShell sections for remediation options.

Remediate from Azure CLI

For each volume group requiring remediation, run the following command to assign an identity:

az elastic-san volume-group update --resource-group <resource-group> --elastic-san <elastic-san> --volume-group <volume-group> --identity "{type:SystemAssigned}"

Note: Use --identity '{type:UserAssigned,user-assigned-identity:"<user-assigned-identity-id>"}' with the above command to provide a UserAssigned Identity Id.

For each volume group requiring remediation, run the following command to assign a customer-managed encryption key:

az elastic-san volume-group update --resource-group <resource-group> --elastic-san <elastic-san> --volume-group <volume-group> --encryption EncryptionAtRestWithCustomerManagedKey --encryption-properties "{key-vault-properties:{key-name:'<key>',key-vault-uri:'<key-vault-uri>'}}"

Remediate from PowerShell

For each volume group requiring remediation, run the following command to assign an identity:

Update-AzElasticSanVolumeGroup -ResourceGroupName <resource-group> -ElasticSanName <elastic-san> -VolumeGroupName <volume-group> -IdentityType SystemAssigned

Note: Use -IdentityType UserAssigned -IdentityUserAssignedIdentityId <user-assigned-identity-id> with the above command to provide a UserAssigned Identity Id.

For each volume group requiring remediation, run the following command to assign a customer-managed encryption key:

Update-AzElasticSanVolumeGroup -ResourceGroupName <resource-group> -ElasticSanName <elastic-san> -VolumeGroupName <volume-group> -Encryption EncryptionAtRestWithCustomerManagedKey -KeyName <key> -KeyVaultUri <key-vault-uri>

Default Value

By default, Azure Elastic SAN volume groups are encrypted using Microsoft-managed keys.

References

1. https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-configure-customer-managed-keys
2. https://learn.microsoft.com/en-us/cli/azure/elastic-san/volume-group
3. https://learn.microsoft.com/en-us/powershell/module/az.elasticsan/get-azelasticsanvolumegroup
4. https://learn.microsoft.com/en-us/powershell/module/az.elasticsan/update-azelasticsanvolumegroup
5. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities

Additional Information

• To enable encryption, it is necessary to grant the volume group the appropriate permissions to access the encryption key in the key vault. The key can be modified as needed. Refer to the following guide for details: https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-configure-customer-managed-keys?#configure-the-key-vault.
• Azure Elastic SAN uses system-assigned managed identities and user-assigned managed identities to authenticate the volume groups to access encryption keys stored in Azure Key Vault. Refer to the following guide for details: https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-configure-customer-managed-keys#choose-a-managed-identity-to-authorize-access-to-the-key-vault.

CIS Controls

Profile

Level 2 | Automated