Back to Checks
azure

Unattached disk is encrypted with a customer-managed key (CMK)

vm_ensure_unattached_disks_encrypted_with_cmk
Service: vmSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.compute/disks

Unattached Azure managed disks use Customer-Managed Keys (CMK) for server-side encryption rather than platform-managed keys. Only disks not currently attached to a VM are in scope.

Prowler logoProwlerprowler-provider-azure

Risk

Without CMK, you lack independent key control on unattached disks. A compromised admin could attach a disk to read or alter data before you can revoke access. Missing customer-controlled rotation and revocation weakens confidentiality and integrity, and can hinder data-sovereignty compliance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks vm_ensure_unattached_disks_encrypted_with_cmk

Recommendation

Encrypt unattached disks with CMK backed by a hardened key service. Enforce least privilege for disk attachment and key usage, enable key rotation and auditing, and restrict access to keys. Apply lifecycle governance-remove stale disks-to reduce exposure and support defense in depth.

Remediation

CLI

az disk update -g <RESOURCE_GROUP> -n <DISK_NAME> --encryption-type EncryptionAtRestWithCustomerKey --disk-encryption-set <DES_ID>

Terraform

# Associate an unattached managed disk with a Disk Encryption Set (CMK)
resource "azurerm_managed_disk" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  create_option       = "Empty"
  disk_size_gb        = 1

  disk_encryption_set_id = "<example_resource_id>" # CRITICAL: enables CMK by linking the Disk Encryption Set
}

NativeIaC

// Update an existing managed disk to use a customer-managed key via Disk Encryption Set
resource example_disk 'Microsoft.Compute/disks@2023-08-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    encryption: {
      type: 'EncryptionAtRestWithCustomerKey' // CRITICAL: switch to CMK-based encryption
      diskEncryptionSetId: '<example_resource_id>' // CRITICAL: DES resource ID that holds the CMK
    }
  }
}

Other

1In Azure portal, go to Disks and open the unattached disk
2Select Encryption
3Set Encryption type to Customer-managed key
4Select the Disk encryption set to use
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.vm.vm_client import vm_client


class vm_ensure_unattached_disks_encrypted_with_cmk(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, disks in vm_client.disks.items():
            subscription_name = vm_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for disk_id, disk in disks.items():
                if not disk.vms_attached:
                    report = Check_Report_Azure(metadata=self.metadata(), resource=disk)
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"Disk '{disk_id}' is encrypted with a customer-managed key in subscription {subscription_name} ({subscription_id})."

                    if (
                        not disk.encryption_type
                        or disk.encryption_type == "EncryptionAtRestWithPlatformKey"
                    ):
                        report.status = "FAIL"
                        report.status_extended = f"Disk '{disk_id}' is not encrypted with a customer-managed key in subscription {subscription_name} ({subscription_id})."

                    findings.append(report)

        return findings

References