Policy: Azure > Storage > Storage Account > Encryption at Rest > Customer Managed Key

Define the KMS key ID for encryption at rest.

Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The Encryption at Rest control compares the encryption settings against the encryption policies for the resource (Azure > Storage > StorageAccount > Encryption at Rest > *), raises an alarm, and takes the defined enforcement action

Please make sure the key defined in the template has required permissions. Note: Ensure that the key vault key should assign Key Vault Crypto Officer role to the storage account.

Targets

This policy targets the following resource types:

Azure > Storage > Storage Account

Primary Policy

This policy is used with the following primary policy:

Azure > Storage > Storage Account > Encryption at Rest

Controls

Setting this policy configures this control:

Azure > Storage > Storage Account > Encryption at Rest

Policy Specification

Schema Type	`string`
Examples [YAML]	https://testvault.vault.azure.net/keys/turbot-default-key

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/resourceEncryptionAtRest

Policy Type URI

tmod:@turbot/azure-storage#/policy/types/storageAccountEncryptionAtRestCustomerManagedKey

GraphQL

query policyType(id: "tmod:@turbot/azure-storage#/policy/types/storageAccountEncryptionAtRestCustomerManagedKey") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/azure-storage#/policy/types/storageAccountEncryptionAtRestCustomerManagedKey'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/azure-storage#/policy/types/storageAccountEncryptionAtRestCustomerManagedKey'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/azure-storage#/policy/types/storageAccountEncryptionAtRestCustomerManagedKey"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-storage#/policy/types/storageAccountEncryptionAtRestCustomerManagedKey"