Azure Disk Encryption for Linux VMs: When Platform-Managed Keys Don't Cut It

The Hidden Risk of Platform-Managed Keys in Azure Disk Encryption

When you enable Azure Disk Encryption (ADE) on a Linux VM using platform-managed keys, you get seamless encryption with zero key management overhead. But this convenience comes with a critical trade-off: Microsoft controls the encryption keys, which may violate compliance requirements or create unacceptable risk for production systems.

Understanding the Platform-Managed Key Model

Azure Disk Encryption supports two key management approaches for Linux VMs:

• Platform-managed keys (PMK): Azure generates and manages the keys automatically. No key rotation, no customer oversight.
• Customer-managed keys (CMK): You provide keys stored in Azure Key Vault, giving you control over rotation and access.

Platform-managed keys use DM-Crypt for data disk encryption and BitLocker for the OS disk on Windows. The encryption happens at the host level during provisioning or can be applied to existing VMs.

The Compliance and Control Problem

Platform-managed keys create several operational risks:

• Regulatory non-compliance: Many standards (FedRAMP, HIPAA, PCI-DSS) require customer-controlled key management.
• No key rotation: You cannot rotate keys without re-encrypting entire disks, which can impact performance.
• Microsoft access: In theory, Microsoft can access your encryption keys, creating potential legal exposure.
• Limited audit trail: You cannot independently verify key usage or access patterns.

Migrating from Platform-Managed to Customer-Managed Keys

You cannot directly convert a VM encrypted with PMK to CMK. You must re-encrypt the disks. Here's a practical approach:

1. Stop the VM and create a snapshot for backup
2. Create a Key Vault with appropriate access policies for your VM's managed identity
3. Generate a key in Key Vault or import your own
4. Update the VM's disk encryption configuration to reference the Key Vault key
5. Start the VM and monitor the encryption process

Risk: This process requires a maintenance window and can cause service interruption.

Verification Checklist

After enabling or migrating to CMK, verify encryption status:

az vm show --resource-group <rg> --name <vm> --query osDisk.encryptionSettings

Check the Azure portal under VM settings > Disks for 'Encryption enabled' status. Review Key Vault access policies to ensure the VM's managed identity has appropriate key permissions. Use Azure Policy to audit encryption compliance across your subscription.

Performance Impact During Initial Encryption

The initial encryption process can affect VM workloads. Monitor CPU utilization and disk I/O during the process. For production systems, consider encrypting during scheduled maintenance windows or using Azure Update Management to coordinate the process.

Actionable Recommendation

If your organization handles regulated data or requires strict key control, migrate from platform-managed to customer-managed keys before going to production. Use Azure Policy to enforce CMK encryption across your subscription and regularly audit your VMs for compliance.