Azure Compliance ControlsAzure Kubernetes Service
AKS clusters should use customer-managed keys to encrypt both OS and data disks
Encrypting OS and data disks using customer-managed keys provides more control and greater flexibility in key management. AKS clusters should define a disk encryption set ID so OS and data disks are encrypted.
What this control checks
AKS clusters must have a disk encryption set ID configured for OS and data disks.
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_os_and_data_disks_encrypted_with_cmk - Checkov Check:
CKV_AZURE_117 - Powerpipe Control:
azure_compliance.control.kubernetes_cluster_os_and_data_disks_encrypted_with_cmk - Azure Policy Definition:
7d7be79c-23ba-4033-84dd-45e2a5ccdd67 - Trivy Check:
AZU-0067
Last reviewed: 2026-10-13