Query: Virtual machines and virtual machine scale sets should have encryption at host enabled

Description

Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches. Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk.

Query

Tables used in this query:

• azure_compute_virtual_machine
• azure_compute_virtual_machine_scale_set
• azure_subscription

Controls using this query:

• Virtual machines and virtual machine scale sets should have encryption at host enabled

SQL