About
This Azure check looks at whether the operating system (OS) disks of your virtual machines are encrypted with customer-managed keys (CMK). Azure encrypts virtual machine OS and data disks with platform-managed keys by default. Using customer-managed keys instead gives you more control:
- You choose when to rotate your keys, to follow your own policies.
- You can stop managed disks from accessing keys, which would cause a virtual machine to fail.
- You can track key usage through Key Vault monitoring.
If the check is failing, the steps below show how to switch a disk to customer-managed keys. You do this in Azure, not in ControlMap. Check results appear in Monitor › Compliance Checks.
Encrypt a disk with a customer-managed key
Do the following in the Azure portal:
- Go to Virtual Machines.
- Select the virtual machine you want to fix.
- Select Disks in the navigation.
- Detach the disk from the virtual machine.
- Go to the disk you just detached and select Encryption.
- Change the encryption type, choose your encryption settings, and select Save.
- Go back to the virtual machine and attach the disk again.
More information
Microsoft describes disk encryption in its data encryption best practices: https://docs.microsoft.com/en-us/azure/security/fundamentals/data-encryption-best-practices
