last sync: 2021-Jul-23 16:37:57 UTC

Azure Policy definition

Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption

Name Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption
Azure Portal
Id d461a302-a187-421a-89ac-84acdb4edc04
Version 2.0.0
details on versioning
Category Compute
Microsoft docs
Description Requiring a specific set of disk encryption sets to be used with managed disks give you control over the keys used for encryption at rest. You are able to select the allowed encrypted sets and all others are rejected when attached to a disk. Learn more at https://aka.ms/disks-cmk.
Mode Indexed
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: Audit
Allowed: (Audit, Deny, Disabled)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2021-03-09 14:37:41 change Major (1.0.0 > 2.0.0)
2021-03-02 15:11:40 add d461a302-a187-421a-89ac-84acdb4edc04
Used in Initiatives none
JSON Changes

JSON
{
  "properties": {
    "displayName": "Managed disks should use a specific set of disk encryption sets for the customer-managed key encryption",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Requiring a specific set of disk encryption sets to be used with managed disks give you control over the keys used for encryption at rest. You are able to select the allowed encrypted sets and all others are rejected when attached to a disk. Learn more at https://aka.ms/disks-cmk.",
    "metadata": {
      "category": "Compute",
      "version": "2.0.0"
    },
    "parameters": {
      "allowedEncryptionSets": {
        "type": "Array",
        "metadata": {
          "displayName": "Allowed disk encryption set",
          "description": "The list of allowed disk encryption sets for managed disks.",
          "strongType": "Microsoft.Compute/diskEncryptionSets"
        }
      },
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "Audit",
          "Deny",
          "Disabled"
        ],
        "defaultValue": "Audit"
      }
    },
    "policyRule": {
      "if": {
        "anyOf": [
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/disks"
              },
              {
                "field": "Microsoft.Compute/disks/managedBy",
                "exists": "False"
              },
              {
                "field": "Microsoft.Compute/disks/encryption.diskEncryptionSetId",
              "notIn": "[parameters('allowedEncryptionSets')]"
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/virtualMachines"
              },
              {
                "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.diskEncryptionSet.id",
              "notIn": "[parameters('allowedEncryptionSets')]"
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/virtualMachineScaleSets"
              },
              {
                "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.osDisk.managedDisk.diskEncryptionSet.id",
              "notIn": "[parameters('allowedEncryptionSets')]"
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/virtualMachineScaleSets"
              },
              {
                "count": {
                "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.dataDisks[*]"
                },
                "greater": 0
              },
              {
                "not": {
                "field": "Microsoft.Compute/virtualMachineScaleSets/virtualMachineProfile.storageProfile.dataDisks[*].managedDisk.diskEncryptionSet.id",
                "in": "[parameters('allowedEncryptionSets')]"
                }
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/galleries/images/versions"
              },
              {
                "not": {
                "field": "Microsoft.Compute/galleries/images/versions/publishingProfile.targetRegions[*].encryption.osDiskImage.diskEncryptionSetId",
                "in": "[parameters('allowedEncryptionSets')]"
                }
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/galleries/images/versions"
              },
              {
              "value": "[length(field('Microsoft.Compute/galleries/images/versions/storageProfile.dataDiskImages[*]'))]",
                "greater": 0
              },
              {
                "not": {
                "field": "Microsoft.Compute/galleries/images/versions/publishingProfile.targetRegions[*].encryption.dataDiskImages[*].diskEncryptionSetId",
                "in": "[parameters('allowedEncryptionSets')]"
                }
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/images"
              },
              {
                "field": "Microsoft.Compute/images/storageProfile.osDisk.diskEncryptionSet.id",
              "notIn": "[parameters('allowedEncryptionSets')]"
              }
            ]
          },
          {
            "allOf": [
              {
                "field": "type",
                "equals": "Microsoft.Compute/images"
              },
              {
              "value": "[length(field('Microsoft.Compute/images/storageProfile.dataDisks[*]'))]",
                "greater": 0
              },
              {
              "field": "Microsoft.Compute/images/storageProfile.dataDisks[*].diskEncryptionSet.id",
              "notIn": "[parameters('allowedEncryptionSets')]"
              }
            ]
          }
        ]
      },
      "then": {
      "effect": "[parameters('effect')]"
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/d461a302-a187-421a-89ac-84acdb4edc04",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "d461a302-a187-421a-89ac-84acdb4edc04"
}