Control: Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.03 - Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key (CMK)

Configures auditing against a CIS Benchmark item.

Level: 2

Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Resource Types

This control targets the following resource types:

Azure > Monitor > Log Profile

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv3-0#/control/types/r060103

Category URI

tmod:@turbot/cis#/control/categories/v071408

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv3-0#/control/types/r060103") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv3-0#/control/types/r060103'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv3-0#/control/types/r060103"