Azure Disk Encryption for Data Disk on Linux
Tags: azure, cloud, linux, security
Published: 2021-04-19 06:46:00

When configuring a new Linux Virtual Machine (VM) you may think your data is stored on Azure hardware which means is encrypted so no further encryption method is needed. It's true Microsoft encrypts its data but this is at [rest](https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest#the-purpose-of-encryption-at-rest), meaning it is protected at the hardware level when there is a physical attack. Other than this, there is no logical encryption of the data disk, leaving you vulnerable if someone was able to download the disk. What I will cover in this post is what type of encryption does Azure uses for Linux Data Disks and how to enable this and attach to a VM.

## What encryption method is used

The Azure platform uses [DM-Crypt](https://en.wikipedia.org/wiki/Dm-crypt) to encrypt Linux VMs data. This is the only method available from Azure when encrypting Linux data.

## How does the encryption key generate and where is it stored

As encryption is a supported method offered by Microsoft, the Azure platform integrated data disk encryption with [Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/general/overview). As part of the encryption process, you will be asked to select a Key Vault (or create a new one) and select or create the key that will be used for the encryption.

## Are there prerequisites

There are a couple requirements you must meet to be able to configure encryption on a data disk:

1. The Linux virtual machine must have at least 2GB of RAM (8GB if you are doing both OS and Data Disk)

1. The OS must be one of the supported operating systems Microsoft have outlined in their [documentation](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-overview#supported-operating-systems)

1. You will need to mount the data disk in advance of encryption so the virtual machine can mount after encryption is enabled. You can follow Microsoft documented approach to this [here](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-overview#additional-vm-requirements).

1. The Azure Key Vault you use must have Enable Access to Azure Disk Encryption for volume encryption policy enabled. If not, the Key Vault used for the procedure below will not work.

## How to enable encryption using the Azure Portal

Make sure you first mount the data disk to the virtual machine and turn it off ready for encryption to start. When ready, follow these steps:

1. Open the **Virtual Machine** resource
1. Select **Disks** from the left side menu
![disks.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1618773544001/pXZae5xRw.png)
1. Select **Additional Settings** from the top of the window
![additional-settings.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1618773628182/yjbO76zXv.png)
1. From the **Disk to encrypt** drop down, select **Data disks**
![encrypt-disk-list.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1618773726184/EDqwetdzA.png)
1. Select the **Click to select a key** option that appeared after the above step completed
![select-keyvault.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1618773992232/SXpGqOuMf.png)
1. Here complete the fields, either by select an existing Key Vault or creating a new. Once done, click the *Select** button
![keyvault-config.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1618774112979/h460mPY7l.png)
1. You will return to the configuration window to finish by selecting **Save**

## How to enable encryption using Azure CLI

Run the following command

```azurecli
az vm encryption enable -g "ResourceGroupName" --name "LinuxVMName" --disk-encryption-keyvault "NameOfKeyVault" --volume-type DATA
```

Replace the following values with your own:

- **ResourceGroupName** - The name of the resource group that the Linux VM is.

- **LinuxVMName** - Name of the Linux VM where the data disk will be encrypted

- **NameOfKeyVault** - Key Vault name you are using for storing the encryption key