Ensure Batch pools disk encryption is set enabled

높음레벨 1수동 검토azure

설명

Azure Batch pools must have disk encryption enabled to protect data at rest on both OS and temporary disks, using Azure-managed encryption keys by default. Enabling disk encryption meets compliance requirements, follows security best practices, and safeguards against unauthorized access to cached data and task outputs stored on VM disks.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Audit from Azure Portal 1. Login to Azure portal https://portal.azure.com 2. Navigate to Batch Accounts For each Batch account perform the following: 1. Expand the Features section then click on Pools 2. For each Pool ID, click the name to open the pool 3. Under the Configuration section, check Disk Encryption If the pool is encrypted, it should display "OS disk" and/or "Temporary disk" encryption enabled. Audit from Azure CLI Run the following commands: # List all pools and their encryption status az batch pool list \ --account-name <batch-account-name> \ --query "[].{id:id, encryption:deploymentConfiguration.virtualMachineConfiguration.diskEncryption Configuration}" \ --output table Expected Output: "OsDisk" and/or "TemporaryDisk" should be listed under encryption.targets. Audit from PowerShell Run the following command: # Get Batch account context $batchContext = Get-AzBatchAccount -AccountName "<batch-account-name>" # List all pools and check encryption Get-AzBatchPool -BatchContext $batchContext | ForEach-Object { $pool = $_ $encryptionConfig = $pool.DeploymentConfiguration.VirtualMachineConfiguration.DiskEncryptionConfi guration [PSCustomObject]@{ PoolId = $pool.Id OsDiskE...

조치 방법

조치 방식: 가이드 또는 인프라 패치

NOTE: Encrypted pools must be created as replacements for unencrypted pools. Please ensure that necessary precautions are taken to backup and restore data from persistent disk pools. Remediate from Azure Portal 1. Navigate to Azure Batch accounts 2. Select your Batch account 3. Click Pools in the left menu 4. For each unencrypted pool, click Create new pool 5. Under Advanced settings, enable Disk encryption and select OS disk or All disks 6. Configure all other settings to match your existing pool 7. Click Create to deploy the encrypted pool 8. Resize the old unencrypted pool to 0 nodes after verifying the new pool is operational Repeat steps 4-8 for each unencrypted pool Remediate from Azure CLI 1. Get pool configuration config=$(az batch pool show --pool-id <pool-name> --query "{vmSize:vmSize,image:virtualMachineConfiguration.imageReference,nodeCount:ta rgetDedicatedNodes}") 2. Create encrypted replacement az batch pool create \ --id "<pool-name>-encrypted" \ --vm-size $(jq -r '.vmSize' <<< "$config") \ --image-reference "$(jq -r '.image.publisher + ":" + .image.offer + ":" + .image.sku + ":" + .image.version' <<< "$config")" \ --node-count $(jq -r '.nodeCount' <<< "$config")...

속성

운영 체제: 모두
태그: azurecloudcomputeencryption
참고 자료: CIS Microsoft Azure Compute Services Benchmark v2.0.0 - 15.2 Ensure Batch pools disk encryption is set enabled