id: azure-openai-cmk-not-enabled
info:
  name: Azure OpenAI Encryption using Customer-Managed Keys Not Enabled
  author: princechaddha
  severity: high
  description: |
    Ensure that your Microsoft Azure OpenAI service instances are using Customer-Managed Keys (CMKs) instead of Microsoft-managed encryption keys (i.e., default keys used by Microsoft Azure for encryption at rest) in order to have a more granular control over your Azure OpenAI data encryption and decryption process.
  impact: |
    Not using Customer-Managed Keys (CMKs) for Azure OpenAI instances can limit your control over encryption keys and potentially expose sensitive data to higher risks.
  remediation: |
    Configure your Azure OpenAI instances to use Customer-Managed Keys by setting up encryption key attributes in the Azure Key Vault and then linking them to your OpenAI service instances.
  reference:
    - https://docs.microsoft.com/en-us/azure/cognitive-services/encryption-key-management
  tags: cloud,devops,azure,microsoft,openai,azure-cloud-config,ai

flow: |
  code(1);
  for (let ServiceData of iterate(template.serviceList)) {
    ServiceData = JSON.parse(ServiceData);
    set("name", ServiceData.Name);
    set("resourceGroup", ServiceData.ResourceGroup);
    code(2);
  }

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      az cognitiveservices account list --output json --query '[?(kind=="OpenAI")].{"Name":name,"ResourceGroup":resourceGroup}'

    extractors:
      - type: json
        name: serviceList
        internal: true
        json:
          - '.[]'

  - engine:
      - sh
      - bash
    source: |
      az cognitiveservices account show --name "$name" --resource-group "$resourceGroup" --query '{"encryptionKey":properties.encryption.keyVaultProperties.keyName}'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'encryptionKey'
          - 'null'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"$name in $resourceGroup does not use CMK"'
# digest: 4a0a00473045022100afdd86b713882a921e9c21b476cb37844ce0635ee1d0c1592eb8aa18f5210dd102201b5725b8bcdb6d39f49cc605f81577c44c01a10d3241e9f23e6ad78c27f86d51:922c64590222798bb761d5b6d8e72950