Virtual machine scale sets do not have encryption at host enabled

Description

Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk.

Code Example

resource "azurerm_windows_virtual_machine_scale_set" "example" {
                  ...
  +               encryption_at_host_enabled = true
                  ...
                  }

Remediation

Terraform

• Resource: azurerm_windows_virtual_machine_scale_set
• Arguments: encryption_at_host_enabled

Rule Details

Field	Value
ID	IAC-0604
Severity	LOW
IaC Type	arm
Frameworks	Terraform, TerraformPlan
Checkov ID	CKV_AZURE_97

References

• Checkov Rule

---