Homepage
About Snyk

Virtual machine legacy virtual hard disk is not encrypted Affecting Compute service in Azure

Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    Data / Encryption at Rest

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Azure
  • Snyk ID SNYK-CC-00700
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Legacy virtual hard disks (VHDs) are stored in Azure blob storage, which is encrypted by default. Encryption should be enabled for virtual machines running VHDs in order to protect the data from unwarranted reads.

How to fix?

Virtual Machine legacy virtual hard disks should be encrypted.

Example Configuration

{
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "apiVersion": "2022-11-01",
            "name": "allowed2/Extensions",
            "location": "[resourceGroup().location]",
            "dependsOn": [
                "[resourceId('Microsoft.Compute/virtualMachines', 'allowed2')]",
                "[resourceId('Microsoft.KeyVault/vaults', 'example-vault-700')]"
            ],
            "properties": {
                "publisher": "Microsoft.Azure.Security",
                "settings": {
                        "EncryptionOperation": "EnableEncryption",
                        "KeyVaultURL": "[reference(resourceId('Microsoft.KeyVault/vaults', 'example-vault-700'), '2022-07-01', 'Full').properties.vaultUri]",
                        "KeyVaultResourceId": "/subscriptions/5f479449-6df7-4c39-af0f-d8837aa02eec/resourceGroups/snyk_3/providers/Microsoft.KeyVault/vaults/example-vault-700",
                        "KeyEncryptionAlgorithm": "RSA-OAEP",
                        "VolumeType": "All"
                },
                "type": "AzureDiskEncryptionForLinux",
                "typeHandlerVersion": "1.1"
            }
        },