Cis Azure Storage 5.1.4

5.1.4 Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults (Automated)

Description

In addition to using customer-managed keys for encryption at rest in the Backup vault, you can enable an additional layer of platform-managed infrastructure encryption. This dual-layer approach enhances the protection of your backup data.

Rationale

Enabling infrastructure encryption on a Backup vault adds a second layer of protection to backup data, enhancing security and ensuring compliance for sensitive data storage. This dual-layer strategy reduces the risk of unauthorized access by keeping data encrypted even if one layer is compromised.

Impact

Enabling infrastructure encryption on a backup vault does not incur additional costs; however, infrastructure encryption must be configured when creating the vault and requires customer-managed keys for encryption at rest. This recommendation is linked to Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK) and should be applied alongside it if you choose to implement this recommendation.

Audit Procedure

Audit from Azure Portal

1. Go to Backup vaults.
2. Click the name of a Backup vault.
3. Under Manage, click Properties.
4. Under Encryption Settings, click Update.
5. Under Infrastructure encryption, ensure the box next to Use infrastructure encryption for this vault is checked.
6. Repeat steps 1-5 for each Backup vault.

Audit from Azure CLI

Run the following command to list Backup vaults:

az dataprotection backup-vault list

For each Backup vault, run the following command:

az dataprotection backup-vault show --resource-group <resource-group> --vault-name <backup-vault>

Ensure that under properties > securitySettings > encryptionSettings, infrastructureEncryption is set to Enabled.

Audit from PowerShell

Run the following command to list Backup vaults:

Get-AzDataProtectionBackupVault

Run the following command to get the Backup vault in a resource group with a given name:

$vault = Get-AzDataProtectionBackupVault -ResourceGroupName <resource-group> -VaultName <backup-vault>

Run the following command to get the infrastructure encryption setting for the Backup vault:

$vault.EncryptionSetting.CmkInfrastructureEncryption

Ensure that the command returns Enabled. Repeat for each Backup vault.

Audit from Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

• Policy ID: d6588149-9f06-462c-a076-56aece45b5ba
• Name: '[Preview]: Azure Backup Vaults should use customer-managed keys for encrypting backup data. Also an option to enforce Infra Encryption.'

Expected Result

Infrastructure encryption should be checked/enabled in the Azure Portal, or properties.securitySettings.encryptionSettings.infrastructureEncryption should be Enabled in CLI output, or $vault.EncryptionSetting.CmkInfrastructureEncryption should return Enabled in PowerShell.

Remediation

Remediate from Azure CLI

Run the following command to create a locally redundant Backup vault with a customer-managed encryption key and infrastructure encryption enabled:

az dataprotection backup-vault create --resource-group <resource-group> --vault-name <backup-vault> --location <location> --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" --type "UserAssigned" --user-assigned-identities '{"<user-assigned-identity-id>":{}}' --cmk-encryption-key-uri <cmk-uri> --cmk-encryption-state Enabled --cmk-identity-type "UserAssigned" --cmk-user-assigned-identity-id <cmk-user-assigned-identity-id> --cmk-infrastructure-encryption Enabled

Remediate from PowerShell

Run the following commands to create a locally redundant Backup vault with a customer-managed encryption key and infrastructure encryption enabled:

$sub = "<subscription-id>"

$storagesetting = New-AzDataProtectionBackupVaultStorageSettingObject -DataStoreType VaultStore -Type LocallyRedundant

$userAssignedIdentity = @{
    "<user-assigned-identity-id>" = @{
        clientId = "<user-assigned-identity-client-id>"
        principalId = "<user-assigned-identity-principal-id>"
    }
}

$cmkIdentityId = "<cmk-user-assigned-identity-id>"

$cmkKeyUri = "<cmk-uri>"

New-AzDataProtectionBackupVault -SubscriptionId $sub -ResourceGroupName <resource-group> -VaultName <backup-vault> -Location <location> -StorageSetting $storagesetting -IdentityType UserAssigned -UserAssignedIdentity $userAssignedIdentity -CmkEncryptionState Enabled -CmkIdentityType UserAssigned -CmkUserAssignedIdentityId $cmkIdentityId -CmkEncryptionKeyUri $cmkKeyUri -CmkInfrastructureEncryption Enabled

Default Value

Infrastructure encryption is disabled by default on Backup vaults.

References

1. https://learn.microsoft.com/en-us/cli/azure/dataprotection/backup-vault
2. https://learn.microsoft.com/en-us/powershell/module/az.dataprotection/get-azdataprotectionbackupvault
3. https://learn.microsoft.com/en-us/powershell/module/az.dataprotection/new-azdataprotectionbackupvault
4. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities

Additional Information

Backup vaults use user-assigned managed identities to authenticate the Backup vault to access encryption keys stored in Azure Key Vault when creating the vault with a customer-managed encryption key and infrastructure encryption enabled. Refer to the following guides for details:

• https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities
• https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault

CIS Controls

Profile

Level 2 | Automated