Using unencrypted cloud storages can lead to data exposure. In the case that adversaries gain physical access to the storage medium they are able
to access unencrypted information.
Ask Yourself Whether
- The service contains sensitive information that could cause harm when leaked.
- There are compliance requirements for the service to store data encrypted.
There is a risk if you answered yes to any of those questions.
Recommended Secure Coding Practices
It’s recommended to encrypt cloud storages that contain sensitive information.
Sensitive Code Example
For azurerm_data_lake_store:
resource "azurerm_data_lake_store" "store" {
name = "store"
encryption_state = "Disabled" # Sensitive
}
Compliant Solution
For azurerm_data_lake_store:
resource "azurerm_data_lake_store" "store" {
name = "store"
encryption_state = "Enabled"
encryption_type = "ServiceManaged"
}
See
