Azure Compliance ControlsAzure Cosmos DB
Azure Cosmos DB accounts should use customer-managed keys to encrypt data at rest
Use customer-managed keys to manage the encryption at rest of your Azure Cosmos DB. By default, the data is encrypted at rest with service-managed keys. Customer-managed keys enable the data to be encrypted with an Azure Key Vault key created and owned by you.
What this control checks
Cosmos DB accounts are checked for customer-managed key (CMK) encryption of data at rest
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cosmosdb_account_encryption_at_rest_using_cmk - Checkov Check:
CKV_AZURE_100 - Powerpipe Control:
azure_compliance.control.cosmosdb_account_encryption_at_rest_using_cmk
Last reviewed: 2026-10-11