HDInsight clusters should have encryption in transit enabled for communication between cluster nodes
Data can be tampered with during transmission between Azure HDInsight cluster nodes. Enabling encryption in transit addresses problems of misuse and tampering during this transmission. The check looks at `Microsoft.HDInsight/clusters`.
Data can be tampered with during transmission between Azure HDInsight cluster nodes. Enabling encryption in transit addresses problems of misuse and tampering during this transmission.
What this control checks
HDInsight clusters must have encryption in transit enabled for communication between cluster nodes
Common pitfalls
Missing property fails the check
The policy matches clusters where encryptionInTransitProperties.isEncryptionInTransitEnabled does not exist or equals false.
Default effect is Audit
The effect parameter allows Audit, Deny or Disabled, with defaultValue Audit.
Clusters not Succeeded are skipped
The Powerpipe check returns 'skip' when provisioning_state is not 'Succeeded'.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure HDInsight clusters should use encryption in transit to encrypt communication between Azure HDInsight cluster nodes" (d9da03a1-f3c3-412a-9709-947156872263); PowerPipe control azure_compliance.control.hdinsight_cluster_encryption_in_transit_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
hdinsight_cluster_encryption_in_transit_enabled - Powerpipe Control:
azure_compliance.control.hdinsight_cluster_encryption_in_transit_enabled - Azure Policy Definition:
d9da03a1-f3c3-412a-9709-947156872263
Last reviewed: 2026-10-13