Ensure Batch pools disk encryption is set enabled

ÉlevéeNiveau 1Revue manuelleazure

Description

Azure Batch pools must have disk encryption enabled to protect data at rest on both OS and temporary disks, using Azure-managed encryption keys by default. Enabling disk encryption meets compliance requirements, follows security best practices, and safeguards against unauthorized access to cached data and task outputs stored on VM disks.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Audit from Azure Portal 1. Login to Azure portal https://portal.azure.com 2. Navigate to Batch Accounts For each Batch account perform the following: 1. Expand the Features section then click on Pools 2. For each Pool ID, click the name to open the pool 3. Under the Configuration section, check Disk Encryption If the pool is encrypted, it should display "OS disk" and/or "Temporary disk" encryption enabled. Audit from Azure CLI Run the following commands: # List all pools and their encryption status az batch pool list \ --account-name <batch-account-name> \ --query "[].{id:id, encryption:deploymentConfiguration.virtualMachineConfiguration.diskEncryption Configuration}" \ --output table Expected Output: "OsDisk" and/or "TemporaryDisk" should be listed under encryption.targets. Audit from PowerShell Run the following command: # Get Batch account context $batchContext = Get-AzBatchAccount -AccountName "<batch-account-name>" # List all pools and check encryption Get-AzBatchPool -BatchContext $batchContext | ForEach-Object { $pool = $_ $encryptionConfig = $pool.DeploymentConfiguration.VirtualMachineConfiguration.DiskEncryptionConfi guration [PSCustomObject]@{ PoolId = $pool.Id OsDiskE...

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

NOTE: Encrypted pools must be created as replacements for unencrypted pools. Please ensure that necessary precautions are taken to backup and restore data from persistent disk pools. Remediate from Azure Portal 1. Navigate to Azure Batch accounts 2. Select your Batch account 3. Click Pools in the left menu 4. For each unencrypted pool, click Create new pool 5. Under Advanced settings, enable Disk encryption and select OS disk or All disks 6. Configure all other settings to match your existing pool 7. Click Create to deploy the encrypted pool 8. Resize the old unencrypted pool to 0 nodes after verifying the new pool is operational Repeat steps 4-8 for each unencrypted pool Remediate from Azure CLI 1. Get pool configuration config=$(az batch pool show --pool-id <pool-name> --query "{vmSize:vmSize,image:virtualMachineConfiguration.imageReference,nodeCount:ta rgetDedicatedNodes}") 2. Create encrypted replacement az batch pool create \ --id "<pool-name>-encrypted" \ --vm-size $(jq -r '.vmSize' <<< "$config") \ --image-reference "$(jq -r '.image.publisher + ":" + .image.offer + ":" + .image.sku + ":" + .image.version' <<< "$config")" \ --node-count $(jq -r '.nodeCount' <<< "$config")...

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: azurecloudcomputeencryption
Référence: CIS Microsoft Azure Compute Services Benchmark v2.0.0 - 15.2 Ensure Batch pools disk encryption is set enabled