App Configuration stores should have encryption enabled
Enabling App Configuration encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. Checkov CKV_AZURE_186 ensures the App configuration encryption block is set.
Enabling App Configuration encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.
What this control checks
App Configuration store has an encryption key_vault_key_identifier set; otherwise it fails
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.app_configuration_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_186.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.h Public Key Infrastructure (PKI)
Related controls
- PostgreSQL servers should use customer-managed keys to encrypt data at rest
- PostgreSQL servers should have infrastructure encryption enabled
- Managed disks should use both platform-managed and customer-managed keys for double encryption
- AKS clusters should use customer-managed keys to encrypt both OS and data disks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
app_configuration_encryption_enabled - Checkov Check:
CKV_AZURE_186 - Powerpipe Control:
azure_compliance.control.app_configuration_encryption_enabled
Last reviewed: 2026-10-09