Container Instance container groups should use customer-managed keys for encryption
Checks that Container Instance container groups use a customer-managed key for encryption. The specified key protects and controls access to the key that encrypts the container group data, and it supports control of key rotation.
When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Using customer-managed keys provides additional capabilities to control rotation of the key encryption key or cryptographically erase data.
What this control checks
Checks the encryption setting on Azure Container Instance container groups
Common pitfalls
Both vaultBaseUrl and keyName must exist
The policy applies its effect if encryptionProperties.vaultBaseUrl does not exist. It also applies its effect if encryptionProperties.keyName does not exist.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Container Instance container group should use customer-managed key for encryption" (0aa61e00-0a01-4a3c-9945-e93cffedf0e6); PowerPipe control azure_compliance.control.container_instance_container_group_encrypted_using_cmk.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_instance_container_group_encrypted_using_cmk - Powerpipe Control:
azure_compliance.control.container_instance_container_group_encrypted_using_cmk - Azure Policy Definition:
0aa61e00-0a01-4a3c-9945-e93cffedf0e6
Last reviewed: 2026-10-11