Data Lake Store accounts should have encryption enabled
This policy ensures encryption is enabled on all Data Lake Store accounts. Checkov CKV_AZURE_105 expects `encryption_state` to be `Enabled` on `azurerm_data_lake_store`. Trivy AZU-0036 flags unencrypted data lake storage.
Datalake storage encryption defaults to Enabled, it shouldn't be overridden to Disabled.
What this control checks
Checks the encryption setting on each Data Lake Store account
Common pitfalls
Missing encryption_state passes the check
Checkov CKV_AZURE_105 inspects encryption_state on azurerm_data_lake_store and expects Enabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Require encryption on Data Lake Store accounts" (a7ff3161-0087-490a-9ad9-ad6217f4f43a); PowerPipe control azure_compliance.control.datalake_store_account_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_105; Trivy check AZU-0036.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0304.09o3Organizational.1-09.o (09.07 Media Handling).
Framework mappings
The clauses this control is mapped to in each framework.
- 0304.09o3Organizational.1-09.o 09.07 Media Handling
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
datalake_store_account_encryption_enabled - Checkov Check:
CKV_AZURE_105 - Powerpipe Control:
azure_compliance.control.datalake_store_account_encryption_enabled - Azure Policy Definition:
a7ff3161-0087-490a-9ad9-ad6217f4f43a - Trivy Check:
AZU-0036
Last reviewed: 2026-10-11