Check ID: storage_infrastructure_encryption_is_enabled
Provider: Azure
Service: storage
Severity: LOW
Categories: encryption
Resource type: microsoft.storage/storageaccounts

​
What this check verifies

Azure Storage accounts have infrastructure encryption enabled, providing double encryption at rest alongside service-level encryption (requireInfrastructureEncryption=true).

​
Risk

Without this second layer, compromise of the service-level key or algorithm can expose stored data, degrading confidentiality and weakening defense in depth. Insider misuse or key theft is more likely to yield readable blobs, files, or tables.

​
Recommendation

Enable infrastructure encryption for accounts or scopes handling sensitive data to strengthen defense in depth. Plan it at creation, as the setting is immutable. Maintain strong key hygiene for service-level encryption (use CMK where appropriate, rotate, restrict access) and enforce guardrails with policy.

​
Remediation

# Storage account with infrastructure encryption enabled
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  infrastructure_encryption_enabled = true # Critical: enables infrastructure-level encryption (double encryption)
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = storage_infrastructure_encryption_is_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks