Policy: Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings > 06.01.03 - Ensure the storage account containing the container with activity logs is encrypted with Customer Managed Key

Configures auditing against a CIS Benchmark item.

Level: 2

Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data, as a given user must have read permission on the corresponding storage account and must be granted decrypt permission by the CMK.

Targets

This policy targets the following resource types:

Azure > Monitor > Log Profile

Primary Policy

This policy is used with the following primary policy:

Azure > CIS v3.0 > 06 - Logging & Monitoring > 06.01 - Configuring Diagnostic Settings

Policy Specification

Schema Type	`string`
Default	`Per Azure > CIS v3.0 > 06 - Logging and Monitoring`
Valid Values [YAML]	`Per Azure > CIS v3.0 > 06 - Logging and Monitoring` `Skip` `Check: Benchmark`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v071408

Policy Type URI

tmod:@turbot/azure-cisv3-0#/policy/types/r060103

GraphQL

query policyType(id: "tmod:@turbot/azure-cisv3-0#/policy/types/r060103") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-cisv3-0#/policy/types/r060103'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-cisv3-0#/policy/types/r060103'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-cisv3-0#/policy/types/r060103"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv3-0#/policy/types/r060103"