Storage account should use customer-managed keys for encryption Storage accounts should use customer-managed keys (CMK) for encryption to provide additional control over the encryption keys.
Customer-managed keys allow you to create, rotate, disable, and revoke access controls.
They also provide greater flexibility to audit the encryption keys that are used to protect your data.
Impact
Recommended Actions Follow the appropriate remediation steps below to resolve the issue.
Terraform
Configure customer-managed keys for storage account encryption
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
data "azurerm_client_config" "current" {}
resource "azurerm_resource_group" "example" {
name = "example-resources"
location = "West Europe"
}
resource "azurerm_user_assigned_identity" "example" {
name = "example-identity"
resource_group_name = azurerm_resource_group . example . name
location = azurerm_resource_group . example . location
}
resource "azurerm_key_vault" "example" {
name = "examplekv"
resource_group_name = azurerm_resource_group . example . name
location = azurerm_resource_group . example . location
tenant_id = data . azurerm_client_config . current . tenant_id
sku_name = "standard"
access_policy {
tenant_id = data . azurerm_client_config . current . tenant_id
object_id = azurerm_user_assigned_identity . example . principal_id
key_permissions = [ "Get", "UnwrapKey", "WrapKey" ]
}
}
resource "azurerm_key_vault_key" "example" {
name = "example-key"
key_vault_id = azurerm_key_vault . example . id
key_type = "RSA"
key_size = 2048
key_opts = [ "decrypt", "encrypt", "unwrapKey", "wrapKey" ]
}
resource "azurerm_storage_account" "good_example" {
name = "storageaccountname"
resource_group_name = azurerm_resource_group . example . name
location = azurerm_resource_group . example . location
account_tier = "Standard"
account_replication_type = "GRS"
customer_managed_key {
key_vault_key_id = azurerm_key_vault_key . example . id
user_assigned_identity_id = azurerm_user_assigned_identity . example . id
}
identity {
type = "UserAssigned"
identity_ids = [ azurerm_user_assigned_identity . example . id ]
}
}
resource "azurerm_storage_container" "good_example" {
name = "content"
storage_account_name = azurerm_storage_account . good_example . name
container_access_type = "private"
}
Links