56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
id: azure-vm-boot-disk-unencrypted
|
|
info:
|
|
name: Azure VM Boot Disk Not Encrypted
|
|
author: princechaddha
|
|
severity: medium
|
|
description: |
|
|
Ensure that your Microsoft Azure virtual machine (VM) boot volumes are encrypted using Azure Disk Encryption in order to meet security and compliance requirements. ADE encrypts the OS and data disks of Azure virtual machines (VMs) using the CPU via the DM-Crypt feature for Linux or the BitLocker feature for Windows. ADE is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets. The boot (OS) volumes encryption and decryption is handled transparently and does not require any additional action from you, your Azure virtual machine, or your cloud application.
|
|
impact: |
|
|
Unencrypted VM boot volumes may expose sensitive data to unauthorized access, violating security and compliance mandates.
|
|
remediation: |
|
|
Enable Azure Disk Encryption for VM boot volumes using Azure Key Vault to manage encryption keys and ensure data security.
|
|
reference:
|
|
- https://docs.microsoft.com/en-us/azure/virtual-machines/linux/encrypt-disks
|
|
tags: cloud,devops,azure,microsoft,vm-disk-encryption,azure-cloud-config
|
|
|
|
flow: |
|
|
code(1);
|
|
for (let VMData of iterate(template.vmList)) {
|
|
VMData = JSON.parse(VMData);
|
|
set("ids", VMData.id);
|
|
code(2);
|
|
}
|
|
|
|
self-contained: true
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az vm list --query '[*].{"id":id}'
|
|
|
|
extractors:
|
|
- type: json
|
|
name: vmList
|
|
internal: true
|
|
json:
|
|
- '.[]'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
az vm encryption show --ids "$ids" --query 'osDisk'
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: stderr
|
|
words:
|
|
- 'Azure Disk Encryption is not enabled'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- 'ids + " VM Boot Disk is not encrypted"'
|
|
# digest: 4a0a00473045022064c4eda2701233110bdb0a284d933a5e217697ba0be3525cf72cb2463f2e085c022100f6cd7bbe9bbc2c329d681c486da7f98f22ac64ba5d6a7cc7952a65cc4cbbb7fe:922c64590222798bb761d5b6d8e72950 |