TMA-ALIBABA-4.1

Ensure that 'Unattached disks' are encrypted

AltaNivel 1Automatizadaalibaba

Descripción

Ensure that unattached disks in a subscription are encrypted. Cloud disk encryption protects your data at rest. The cloud disk data encryption feature automatically encrypts data when data is transferred from ECS instances to disks, and decrypts data when the data is read from ... Counts disks with Status Available (unattached) and Encrypted false in every ECS region; the count must be 0. Read-only aliyun CLI calls; credentials and default region come from the CLI's normal profile (aliyun configure, ~/.aliyun/config.json or ALIBABA_CLOUD_* environment variables). JSON output is parsed with sed/awk. A missing CLI or credential fails the check.

Cómo se verifica

Método de auditoría: Comando de shell

shell

regs=$(aliyun ecs DescribeRegions 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$regs" | sed -n 's/.*"RegionId"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | sort -u)
[ -n "$regions" ] || exit 1
bad=0
for r in $regions; do
  out=$(aliyun ecs DescribeDisks --RegionId "$r" --Status Available --Encrypted false --PageSize 10 2>/dev/null) || exit 1
  n=$(printf '%s\n' "$out" | sed -n 's/.*"TotalCount"[[:space:]]*:[[:space:]]*\([0-9]\{1,\}\).*/\1/p' | head -n 1)
  [ "${n:-0}" -eq 0 ] || { echo "unencrypted unattached disks in $r: $n"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Encrypted cannot be switched on for an existing disk: create an encrypted snapshot copy / encrypted disk from a snapshot (aliyun ecs CopySnapshot --Encrypted true, CreateDisk --Encrypted true --KMSKeyId <key>), swap it in, and enable account-level default EBS encryption for new disks.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: alibabaecs
Referencia: CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 4.1 Ensure that 'Unattached disks' are encrypted

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target alibaba