Pipeline: 4.2 Ensure that 'Enable Infrastructure Encryption' for Each Storage Account in Azure Storage is Set to 'enabled'

Description

Enabling encryption at the hardware level on top of the default software encryption for Storage Accounts accessing Azure storage solutions.

Azure Storage automatically encrypts all data in a storage account at the network level using 256-bit AES encryption, which is one of the strongest, FIPS 140-2-compliant block ciphers available. Customers who require higher levels of assurance that their data is secure can also enable 256-bit AES encryption at the Azure Storage infrastructure level for double encryption. Double encryption of Azure Storage data protects against a scenario where one of the encryption algorithms or keys may be compromised. Similarly, data is encrypted even before network transmission and in all backups. In this scenario, the additional layer of encryption continues to protect your data. For the most secure implementation of key based encryption, it is recommended to use a Customer Managed asymmetric RSA 2048 Key in Azure Key Vault.

Remediation

From Azure Portal

During Storage Account creation, in the Encryption tab, check the box next to Enable infrastructure encryption.

From Azure CLI

Replace the information within <> with appropriate values:

az storage account create \
 --name <storage-account> \
 --resource-group <resource-group> \
 --location <location> \
 --sku Standard_RAGRS \
 --kind StorageV2 \
 --require-infrastructure-encryption

From PowerShell

Replace the information within <> with appropriate values:

New-AzStorageAccount -ResourceGroupName <resource_group> `
 -AccountName <storage-account> `
 -Location <location> `
 -SkuName "Standard_RAGRS" `
 -Kind StorageV2 `
 -RequireInfrastructureEncryption

Enabling Infrastructure Encryption after Storage Account Creation

If infrastructure encryption was not enabled on blob storage creation, there is no official way to enable it. Please see the additional information section.

Default Value

By default, Infrastructure Encryption is disabled in blob creation.

Run the pipeline

To run this pipeline from your terminal:

flowpipe pipeline run azure_cis.pipeline.cis_v300_4_2

Use this pipeline

To call this pipeline from your pipeline, use a step:

step "pipeline" "step_name" {
  pipeline = azure_cis.pipeline.cis_v300_4_2  
}

Params

Name	Type	Required	Description	Default
database	connection.steampipe	Yes	Database connection string.	`connection.steampipe.default`
notifier	notifier	Yes	The name of the notifier to use for sending notification messages.	`notifier.default`
notification_level	string	Yes	The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'.	`info`

Outputs

This pipeline has no outputs.