Back to Checks
azure

Databricks workspace uses a customer-managed key (CMK) for encryption at rest

databricks_workspace_cmk_encryption_enabled
Service: databricksSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.databricks/workspaces

Azure Databricks workspaces are evaluated for use of customer-managed keys (CMK) on at-rest encryption, based on the workspace's managed disk encryption configuration.

Prowler logoProwlerprowler-provider-azure

Risk

Without CMK, keys are provider-controlled, degrading confidentiality and incident response.

  • Slower revoke/rotate during breaches
  • Weaker separation of duties and audit trails
  • Larger blast radius if storage or control plane is compromised

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks databricks_workspace_cmk_encryption_enabled

Recommendation

Enable CMK for workspace encryption via Key Vault or Managed HSM and enforce:

  • Least privilege for key usage
  • Regular rotation and retire old versions
  • Audit logging and alerts on key ops
  • Separation of duties for key vs data roles
  • Deny-by-default policies limiting scope

Remediation

CLI

az databricks workspace update --name <workspace_name> --resource-group <resource_group_name> --key-source Microsoft.Keyvault --key-name <key_name> --key-vault https://<key_vault_name>.vault.azure.net/ --key-version <key_version>

Terraform

resource "azurerm_databricks_workspace" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<region>"
  sku                 = "premium"

  customer_managed_key_enabled      = true  # CRITICAL: enable CMK
  managed_disk_cmk_key_vault_key_id = "<example_resource_id>" # CRITICAL: key ID (Key Vault key) for managed disks
}

NativeIaC

resource ws 'Microsoft.Databricks/workspaces@2023-02-01' = {
  name: '<example_resource_name>'
  location: '<region>'
  sku: {
    name: 'premium'
  }
  properties: {
    encryption: {
      keySource: 'Microsoft.Keyvault' // CRITICAL: enables CMK from Key Vault
      managedDiskKeyVaultProperties: { // CRITICAL: sets CMK for managed disks (encryption at rest)
        keyVaultUri: 'https://<key_vault_name>.vault.azure.net/'
        keyName: '<key_name>'
        keyVersion: '<key_version>'
      }
    }
  }
}

Other

1In Azure Portal, go to your Databricks workspace
2Select Settings > Encryption (or Customer-managed keys)
3If prompted, click Prepare encryption and wait for completion
4Set Key source to Microsoft Key Vault
5Select the Key Vault key and specific key version for managed disks
6Save to apply customer-managed key encryption

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.databricks.databricks_client import (
    databricks_client,
)


class databricks_workspace_cmk_encryption_enabled(Check):
    """
    Ensure Azure Databricks workspaces use customer-managed keys (CMK) for encryption at rest.

    This check evaluates whether each Azure Databricks workspace in the subscription is configured to use a customer-managed key (CMK) for encrypting data at rest.

    - PASS: The workspace has CMK encryption enabled (managed_disk_encryption is set).
    - FAIL: The workspace does not have CMK encryption enabled.
    """

    def execute(self):
        findings = []
        for subscription, workspaces in databricks_client.workspaces.items():
            subscription_name = databricks_client.subscriptions.get(
                subscription, subscription
            )
            for workspace in workspaces.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=workspace
                )
                report.subscription = subscription
                enc = workspace.managed_disk_encryption
                if enc:
                    report.status = "PASS"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has customer-managed key (CMK) encryption enabled with key {enc.key_vault_uri}/{enc.key_name}/{enc.key_version}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not have customer-managed key (CMK) encryption enabled."
                findings.append(report)
        return findings

References