> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Storage Account container containing the logs is encrypted with BYOK ### More Info: Configuring the storage account with the activity log export container to use BYOK (Use Your Own Key) provides additional confidentiality controls on log data as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK. ### Risk Level Low ### Address Operational Maturity, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AZURE * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Cyber Security Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Ensure Storage Account container containing the logs is encrypted with BYOK" for Azure using the Azure console, follow the below steps: 1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Navigate to the Storage account that is being used to store the logs. 3. Click on the "Containers" option under the "Blob service" section in the left-hand menu. 4. Select the container that contains the logs. 5. Click on the "Encryption" option in the left-hand menu. 6. Select the "Customer-managed key" option. 7. Select the key that you want to use for encryption from the dropdown list. 8. Click on the "Save" button to apply the changes. By following these steps, you will ensure that the Storage Account container containing the logs is encrypted with BYOK in Azure. # To remediate this misconfiguration in AZURE using AZURE CLI, follow the below steps: 1. Open the AZURE CLI and login to your AZURE account using the command: `az login` 2. Once you have successfully logged in, set the subscription that contains the storage account container using the command: `az account set --subscription ` 3. Next, get the resource ID of the storage account container using the command: `az storage account show -n -g --query id --output tsv` 4. Now, create a new customer-managed key (CMK) using the command: `az keyvault create -n -g --location --sku standard` 5. Once the key vault is created, get the key identifier using the command: `az keyvault key show --vault-name -n --query key.kid --output tsv` 6. Now, enable encryption for the storage account container using the command: `az storage account update -n -g --encryption-services blob --encryption-key-name --encryption-key-vault ` Replace `` with the name of the key you created in step 4, and `` with the URI of the key vault you created in step 4. 7. Finally, verify that the storage account container is encrypted with BYOK using the command: `az storage container show -n --account-name --account-key --query properties.encryption` Replace `` with the name of the container, `` with the name of the storage account, and `` with the access key for the storage account. That's it! You have successfully remediated the misconfiguration by encrypting the storage account container with BYOK in AZURE using AZURE CLI. To remediate the misconfiguration in Azure, you can use the Azure Python SDK to encrypt the Storage Account container containing the logs with BYOK. Here are the step-by-step instructions: 1. First, you need to create a new key vault in Azure to store the encryption key. You can use the following code to create a new key vault: ```python theme={null} from azure.mgmt.keyvault import KeyVaultManagementClient from azure.mgmt.resource import ResourceManagementClient from azure.identity import DefaultAzureCredential credential = DefaultAzureCredential() resource_group_name = 'my-resource-group' key_vault_name = 'my-key-vault' location = 'eastus' resource_client = ResourceManagementClient(credential, subscription_id) keyvault_client = KeyVaultManagementClient(credential, subscription_id) key_vault_params = { 'location': location, 'properties': { 'sku': { 'name': 'standard' }, 'tenantId': tenant_id, 'accessPolicies': [], 'enabledForDeployment': True, 'enabledForDiskEncryption': True, 'enabledForTemplateDeployment': True } } key_vault = keyvault_client.vaults.create_or_update(resource_group_name, key_vault_name, key_vault_params) ``` 2. Once you have created the key vault, you can create a new encryption key in the key vault using the following code: ```python theme={null} from azure.keyvault.keys import KeyClient from azure.keyvault.keys.crypto import CryptographyClient key_client = KeyClient(vault_url=key_vault.properties.vault_uri, credential=credential) key_name = 'my-encryption-key' # Create a new key key = key_client.create_rsa_key(key_name, hsm=False, size=2048) # Get the key's ID and version key_id = key.id key_version = key.properties.version # Create a cryptography client for the key crypto_client = CryptographyClient(key_id, credential) ``` 3. Next, you need to enable encryption for the Storage Account container containing the logs. You can use the following code to enable encryption: ```python theme={null} from azure.storage.blob import BlobServiceClient from azure.storage.blob.models import BlobEncryptionPolicy, ClientSideEncryptionAlgorithm storage_account_name = 'my-storage-account' container_name = 'my-container' blob_service_client = BlobServiceClient.from_connection_string(storage_connection_string) container_client = blob_service_client.get_container_client(container_name) # Create a new encryption policy with the encryption key encryption_policy = BlobEncryptionPolicy( client_side_encryption_algorithm=ClientSideEncryptionAlgorithm.AES_CBC_256, key_wrap_algorithm='RSA-OAEP', key_encryption_key=crypto_client ) # Enable encryption for the container container_properties = container_client.get_container_properties() container_properties.default_encryption_scope = 'my-encryption-scope' container_client.set_container_properties(container_properties) ``` 4. Finally, you need to verify that the encryption is enabled for the Storage Account container. You can use the following code to verify: ```python theme={null} from azure.storage.blob import BlobProperties blob_client = container_client.get_blob_client('my-blob') # Get the blob properties to verify encryption blob_properties = blob_client.get_blob_properties() assert isinstance(blob_properties.encryption_scope, BlobEncryptionPolicy) ``` With these steps, you can remediate the misconfiguration in Azure by encrypting the Storage Account container containing the logs with BYOK. ```hcl theme={null} resource "azurerm_storage_account" "LOGS_STORAGE_ACCOUNT" { name = "LOGS_STORAGE_ACCOUNT_NAME" # e.g. "stlogsexportprod001" resource_group_name = "LOGS_STORAGE_ACCOUNT_RG_NAME" # e.g. "rg-monitoring-prod" location = "LOGS_STORAGE_ACCOUNT_LOCATION" # e.g. "westeurope" account_tier = "Standard" account_replication_type = "LRS" account_kind = "StorageV2" # Required so the storage account can use a CMK (BYOK) identity { type = "SystemAssigned" } # Use your own key (BYOK) for encryption of blobs/file shares customer_managed_key { key_vault_key_id = azurerm_key_vault_key.LOGS_CMK.id user_assigned_identity_id = null } # Other existing settings for the storage account go here... } resource "azurerm_key_vault" "LOGS_KV" { name = "KEY_VAULT_NAME" # e.g. "kv-logscmk-prod" resource_group_name = "KEY_VAULT_RG_NAME" location = "KEY_VAULT_LOCATION" tenant_id = "TENANT_ID" sku_name = "standard" # Ensure soft delete and purge protection are enabled per Azure requirements for CMK soft_delete_retention_days = 90 purge_protection_enabled = true # Other key vault settings... } resource "azurerm_key_vault_key" "LOGS_CMK" { name = "KEY_NAME_FOR_LOGS_ENCRYPTION" # e.g. "logs-cmk" key_vault_id = azurerm_key_vault.LOGS_KV.id key_type = "RSA" key_size = 2048 key_opts = [ "encrypt", "decrypt", "wrapKey", "unwrapKey", ] } resource "azurerm_key_vault_access_policy" "STORAGE_TO_KV" { key_vault_id = azurerm_key_vault.LOGS_KV.id tenant_id = "TENANT_ID" object_id = azurerm_storage_account.LOGS_STORAGE_ACCOUNT.identity[0].principal_id key_permissions = [ "get", "wrapKey", "unwrapKey", ] } ``` Substitute: * `LOGS_STORAGE_ACCOUNT_NAME`, `LOGS_STORAGE_ACCOUNT_RG_NAME`, `LOGS_STORAGE_ACCOUNT_LOCATION` with the storage account that is configured as the Azure Monitor log export destination. * `KEY_VAULT_NAME`, `KEY_VAULT_RG_NAME`, `KEY_VAULT_LOCATION`, `TENANT_ID`, and `KEY_NAME_FOR_LOGS_ENCRYPTION` with your actual values. This change updates the existing storage account in place (no forced replacement), switching its encryption to use a customer-managed key (BYOK) for the container that holds Azure Monitor logs. For verification, `terraform plan` should show: * an in-place update to `azurerm_storage_account.LOGS_STORAGE_ACCOUNT` adding `identity` and `customer_managed_key`. * creation of `azurerm_key_vault.LOGS_KV`, `azurerm_key_vault_key.LOGS_CMK`, and `azurerm_key_vault_access_policy.STORAGE_TO_KV` (if they are not already managed). ### Additional Reading: * [https://docs.microsoft.com/en-us/cli/azure/monitor/log-profiles?view=azure-cli-latest%23az-monitor-log-profiles-update](https://docs.microsoft.com/en-us/cli/azure/monitor/log-profiles?view=azure-cli-latest%23az-monitor-log-profiles-update)