Skip to content

enable-disk-encryption

Default Severity: high

Explanation

Manage disks should be encrypted at rest. When specifying the encryption_settings block, the enabled attribute should be set to true.

Possible Impact

Data could be read if compromised

Suggested Resolution

Enable encryption on managed disks

Insecure Example

The following example will fail the azure-compute-enable-disk-encryption check. 

 resource "azurerm_managed_disk" "bad_example" {
    encryption_settings {
        enabled = false
    }
 }

Secure Example

The following example will pass the azure-compute-enable-disk-encryption check. 

 resource "azurerm_managed_disk" "good_example" {
    encryption_settings {
        enabled = true
    }
 }