Azure Compliance ControlsAzure Container Instances
Container Instance container groups should use customer-managed keys for encryption
Checks that Container Instance container groups use a customer-managed key for encryption. The specified key protects and controls access to the key that encrypts the container group data, and it supports control of key rotation.
What this control checks
Checks the encryption setting on Azure Container Instance container groups
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_instance_container_group_encrypted_using_cmk - Powerpipe Control:
azure_compliance.control.container_instance_container_group_encrypted_using_cmk - Azure Policy Definition:
0aa61e00-0a01-4a3c-9945-e93cffedf0e6
Last reviewed: 2026-10-11