AKS clusters should use customer-managed keys to encrypt both OS and data disks

Encrypting OS and data disks using customer-managed keys provides more control and greater flexibility in key management. AKS clusters should define a disk encryption set ID so OS and data disks are encrypted.

Encrypting OS and data disks using customer-managed keys provides more control and greater flexibility in key management. This is a common requirement in many regulatory and industry compliance standards.

What this control checks

AKS clusters must have a disk encryption set ID configured for OS and data disks.

Common pitfalls

Any disk_encryption_set_id value is accepted

Checkov CKV_AZURE_117 inspects disk_encryption_set_id and expects ANY_VALUE. The check fails when the disk_encryption_set_id argument is missing.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Both operating systems and data disks in Azure Kubernetes Service clusters should be encrypted by customer-managed keys" (7d7be79c-23ba-4033-84dd-45e2a5ccdd67); PowerPipe control azure_compliance.control.kubernetes_cluster_os_and_data_disks_encrypted_with_cmk.

Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_117; Trivy check AZU-0067.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).

FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

Cryptographic Key Establishment And Management (SC-12)

FedRAMP Moderate Baseline Rev 4

SC-12 Cryptographic Key Establishment And Management

NIST SP 800-171 Rev 2

3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems

CMMC 2.0 Level 2

SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems

FedRAMP High

SC-12 Cryptographic Key Establishment And Management

Key vaults should have soft delete enabled

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: kubernetes_cluster_os_and_data_disks_encrypted_with_cmk
Checkov Check: CKV_AZURE_117
Powerpipe Control: azure_compliance.control.kubernetes_cluster_os_and_data_disks_encrypted_with_cmk
Azure Policy Definition: 7d7be79c-23ba-4033-84dd-45e2a5ccdd67
Trivy Check: AZU-0067

Last reviewed: 2026-10-13

View all Azure controls →