AzPolicyAdvertizer

last sync: 2021-Oct-22 15:42:38 UTC

Azure Policy definition

Azure Container Instance container group should use customer-managed key for encryption

Name Azure Container Instance container group should use customer-managed key for encryption
Azure Portal
Id 0aa61e00-0a01-4a3c-9945-e93cffedf0e6
Version 1.0.0
details on versioning
Category Container Instance
Microsoft docs
Description Secure your containers with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.
Mode Indexed
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: Audit
Allowed: (Audit, Disabled, Deny)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-03-09 14:37:41 add 0aa61e00-0a01-4a3c-9945-e93cffedf0e6
Used in Initiatives
Initiative DisplayName Initiative Id Initiative Category State
[Preview]: NIST SP 800-53 Rev. 5 179d1daa-458f-4e47-8086-2a68d0d6c38f Regulatory Compliance Preview
FedRAMP High d5264498-16f4-418a-b659-fa7ef418175f Regulatory Compliance GA
FedRAMP Moderate e95f5a9f-57ad-4d03-bb0b-b1d16db93693 Regulatory Compliance GA
NIST SP 800-53 Rev. 4 cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f Regulatory Compliance GA
JSON 
{
  "displayName": "Azure Container Instance container group should use customer-managed key for encryption",
  "policyType": "BuiltIn",
  "mode": "Indexed",
  "description": "Secure your containers with greater flexibility using customer-managed keys. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.",
  "metadata": {
    "version": "1.0.0",
    "category": "Container Instance"
  },
  "parameters": {
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "Enable or disable the execution of the policy"
      },
      "allowedValues": [
        "Audit",
        "Disabled",
        "Deny"
      ],
      "defaultValue": "Audit"
    }
  },
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.ContainerInstance/containerGroups"
        },
        {
          "anyOf": [
            {
              "field": "Microsoft.ContainerInstance/containerGroups/encryptionProperties.vaultBaseUrl",
              "exists": false
            },
            {
              "field": "Microsoft.ContainerInstance/containerGroups/encryptionProperties.keyName",
              "exists": false
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "[parameters('effect')]"
    }
  }
}