Cis Azure Storage 5.2.3

5.2.3 Ensure backup data in Recovery Services vaults is encrypted using customer-managed keys (CMK) (Automated)

Description

Recovery Services vaults offer two encryption options: Microsoft-managed keys, which provide automatic encryption without user intervention, and customer-managed keys (CMK), which allow organizations to retain full control over their encryption keys for enhanced security and compliance.

Rationale

Using customer-managed keys (CMKs) to encrypt Recovery Services vaults enhances security by granting organizations complete control over their encryption keys.

Impact

There are costs and configuration overhead associated with setting up and managing customer-managed keys.

Audit Procedure

Audit from Azure Portal

1. Go to Recovery Services vaults.
2. Click the name of a Recovery Services vault.
3. Under Settings, click Properties.
4. Under Encryption Settings, click Update.
5. Ensure the box next to Use your own key is checked, and a key URI is displayed under Encryption key.
6. Repeat steps 1-5 for each Recovery Services vault.

Audit from Azure CLI

Run the following command to list Recovery Services vaults:

az backup vault list

For each Recovery Services vault, run the following command:

az backup vault encryption show --resource-group <resource-group> --name <recovery-services-vault>

Ensure that under properties, encryptionAtRestType is set to CustomerManaged, and a key keyUri exists with the value set to a customer-managed key URI.

Audit from PowerShell

Run the following command to list Recovery Services vaults:

Get-AzRecoveryServicesVault

Run the following command to get the Recovery Services vault in a resource group with a given name:

$vault = Get-AzRecoveryServicesVault -ResourceGroupName <resource-group> -Name <recovery-services-vault>

Run the following command to get the encryption setting for the Recovery Services vault:

$vault.Properties.EncryptionProperty.KeyVaultProperties

Ensure that the command returns a customer-managed key URI. Repeat for each Recovery Services vault.

Audit from Azure Policy

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions

• Policy ID: 2e94d99a-8a36-4563-bc77-810d8893b671
• Name: '[Preview]: Azure Recovery Services vaults should use customer-managed keys for encrypting backup data'

Expected Result

• properties.encryptionAtRestType is set to CustomerManaged
• A keyUri exists with the value set to a customer-managed key URI
• In Azure Portal, Use your own key is checked and a key URI is displayed under Encryption key

Remediation

Note: Once encryption is configured to use a customer-managed key, this setting cannot be reversed.

Remediate from Azure Portal

1. Go to Recovery Services vaults.
2. Click the name of a Recovery Services vault.
3. Under Settings, click Properties.
4. Under Encryption Settings, click Update.
5. Check the box next to Use your own key.
6. Under Encryption key, click the radio button next to Enter key URI to provide a known key URI, or click the radio button next to Select from Key Vault to select a key from a Key Vault.
7. If entering a key URI, provide the key URI in the text box under Key URI.
8. If selecting a key from a Key Vault, click select key from Key Vault.
   1. Select Key vault or Managed HSM.
   2. Select a key vault or managed HSM.
   3. Select a key.
   4. Click Select.
9. Select a managed identity to use for the encryption key.
10. Click Update.
11. Repeat steps 1-10 for each Recovery Services vault.

Remediate from Azure CLI

For each Recovery Services vault requiring remediation, run the following command to assign a customer-managed encryption key:

az backup vault encryption update --resource-group <resource-group> --name <recovery-services-vault> --encryption-key-id <cmk-uri> --mi-system-assigned

Note: Use --mi-user-assigned with the above command to provide a UserAssigned Identity Id.

Remediate from PowerShell

For each Recovery Services vault requiring remediation, run the following command to assign a customer-managed encryption key:

Set-AzRecoveryServicesVaultProperty -VaultId <recovery-services-vault-id> -EncryptionKeyId <cmk-uri> -UseSystemAssignedIdentity $true

Note: Use -UseSystemAssignedIdentity $false with the above command and -UserAssignedIdentity to provide a UserAssigned Identity Id.

Default Value

By default, data in the Recovery Services vault is encrypted using Microsoft-managed keys.

References

1. https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk
2. https://learn.microsoft.com/en-us/cli/azure/backup/vault
3. https://learn.microsoft.com/en-us/powershell/module/az.recoveryservices/get-azrecoveryservicesvault
4. https://learn.microsoft.com/en-us/powershell/module/az.recoveryservices/set-azrecoveryservicesvaultproperty
5. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities

Additional Information

• This feature can only be applied to new Recovery Services vaults. Unfortunately, vaults that currently contain existing items that are registered or have previously attempted registration are not supported.
• To enable encryption, it is necessary to grant the Recovery Services vault the appropriate permissions to access the encryption key in the key vault. The key can be modified as needed. Refer to the following guide for details: https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk#assign-permissions-to-the-recovery-services-vault-to-access-the-encryption-key-in-azure-key-vault.
• Azure Backup uses system-assigned managed identities and user-assigned managed identities to authenticate the Recovery Services vault to access encryption keys stored in Azure Key Vault. Refer to the following guide for details: https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk#enable-a-managed-identity-for-your-recovery-services-vault.

CIS Controls

Profile

Level 2 | Automated