Control: Azure > Storage > Storage Account > Encryption at Rest
Define the Encryption at Rest settings required for Azure > Storage > StorageAccount.
Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption.
The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (Azure > Storage > StorageAccount > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action.
Note: Ensure that the key vault key should assign Key Vault Crypto Officer role to the storage account.
Resource Types
This control targets the following resource types:
Primary Policies
The following policies can be used to configure this control:
Category
In Your Workspace
Developers
- tmod:@turbot/azure-storage#/control/types/storageAccountEncryptionAtRest
- tmod:@turbot/turbot#/control/categories/resourceEncryptionAtRest
- turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-storage#/control/types/storageAccountEncryptionAtRest"
Get Controls
Control Type URI
Category URI
GraphQL
CLI