Cis Azure Storage 10.1

10.1 Ensure 'Encryption key source' is set to 'Customer Managed Key' for Azure NetApp Files accounts (Automated)

Description

Customer-managed keys (CMK) for Azure NetApp Files volume encryption enable organizations to use their own keys instead of platform-managed ones, providing full control over encryption.

Rationale

Using customer-managed keys (CMKs) to encrypt Azure NetApp Files volumes enhances security by granting organizations complete control over their encryption keys.

Impact

There are costs and configuration overhead associated with setting up and managing customer-managed keys.

Audit Procedure

Audit from Azure Portal

1. Go to Azure NetApp Files.
2. Click the name of a NetApp account.
3. Under Azure NetApp Files, click Encryption.
4. Ensure that Encryption key source is set to Customer Managed Key.
5. Repeat steps 1-4 for each NetApp Files account.

Audit from Azure CLI

Run the following command to list NetApp Files accounts:

az netappfiles account list

For each NetApp Files account, run the following command:

az netappfiles account show --resource-group <resource-group> --account-name <netapp-files-account>

Ensure that under encryption, keySource is set to Microsoft.KeyVault.

Audit from PowerShell

Run the following command to install the Az.NetAppFiles module:

Install-Module Az.NetAppFiles

Enter Y when prompted.

Run the following command to list NetApp Files accounts:

Get-AzResource | ? {$_.ResourceType -like 'Microsoft.NetApp/netAppAccounts'} | Format-Table

Run the following command to get the NetApp Files account in a resource group with a given name:

$netapp = Get-AzNetAppFilesAccount -ResourceGroupName <resource-group> -Name <netapp-files-account>

Run the following command to get the encryption key source for the NetApp Files account:

$netapp.Encryption.KeySource

Ensure that the command returns Microsoft.KeyVault. Repeat for each NetApp Files account.

Expected Result

Under encryption, keySource is set to Microsoft.KeyVault.

Remediation

Remediate from Azure Portal

1. Go to Azure NetApp Files.
2. Click the name of a NetApp account.
3. Under Azure NetApp Files, click Encryption.
4. Next to Encryption key source, click the radio button next to Customer Managed Key.
5. Next to Encryption key, click the radio button next to Enter key URI to provide a known key URI, or click the radio button next to Select from key vault to select a key from a key vault.
6. If entering a key URI, provide the key URI in the text box next to Key URI.
7. If selecting a key from a key vault, click Select a key vault and key.
   1. From the drop-down menu next to Key vault, select a key vault.
   2. From the drop-down menu next to Key, select a key.
   3. Click Select.
8. Next to Identity type, click the radio button next to System-assigned to use a system-assigned managed identity, or click the radio button next to User-assigned to use a user-assigned managed identity.
9. If selecting a user-assigned managed identity, next to User-assigned identity, click Select an identity.
   1. In the filter box, type to filter by identity name and/or resource group name.
   2. Check the box next to a managed identity.
   3. Click Add.
10. Click Save.
11. Repeat steps 1-10 for each NetApp Files account.

Remediate from Azure CLI

For each NetApp Files account requiring remediation, run the following command to assign a customer-managed encryption key:

az netappfiles account update --resource-group <resource-group> --account-name <netapp-files-account> --key-source Microsoft.KeyVault --key-name <key-name> --key-vault-uri <key-vault-uri> --keyvault-resource-id <key-vault-resource-id> --identity-type SystemAssigned

Note: Use --identity-type UserAssigned --user-assigned-identity <user-assigned-identity-id> with the above command to provide a UserAssigned Identity Id.

Default Value

By default, data in the NetApp Files account is encrypted using Microsoft-managed keys.

References

1. https://learn.microsoft.com/en-us/azure/azure-netapp-files/configure-customer-managed-keys
2. https://learn.microsoft.com/en-us/cli/azure/netappfiles
3. https://learn.microsoft.com/en-us/powershell/module/az.netappfiles/get-aznetappfilesaccount

Profile

Level 2 | Automated