Virtual Machine disks use a customer-managed key

# Encrypt a managed disk with a customer-managed key via Disk Encryption Set (DES)
resource "azurerm_managed_disk" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<LOCATION>"
  resource_group_name = "<example_resource_name>"
  storage_account_type = "Standard_LRS"
  create_option        = "Empty"
  disk_size_gb         = 32

  # CRITICAL: Attach DES to enable SSE with CMK and pass the check
  disk_encryption_set_id = "<example_resource_id>" # critical: DES ID
}

// Encrypt a managed disk with a customer-managed key via Disk Encryption Set (DES)
resource disk 'Microsoft.Compute/disks@2023-10-02' = {
  name: '<example_resource_name>'
  location: '<LOCATION>'
  sku: {
    name: 'Standard_LRS'
  }
  properties: {
    creationData: {
      createOption: 'Empty'
    }
    diskSizeGB: 32

    // CRITICAL: Use CMK by attaching a Disk Encryption Set (DES)
    // This switches encryption from platform-managed to customer-managed
    encryption: {
      type: 'EncryptionAtRestWithCustomerKey' // critical: CMK
      diskEncryptionSetId: '<example_resource_id>' // critical: DES resource ID
    }
  }
}