Why Disable-AzureRmVMDiskEncryption doesn't need either key encryption key or disk encryption key urls

Question

The Disable-AzureRmVMDiskEncryption cmdlet (I believe disable = decryption) just needs a name of the VM to disable encryption.

Isn't it a security issue disabling encryption without any key ? How can the disks be safeguarded from disabling encryption, through RBAC ?

Answer 1

Isn't it a security issue disabling encryption without any key ?

It doesn't look like a security concern because there are two separate concerns at play here:

1. Protecting Data at rest - which is taken care of by Azure Disk Encryption (only if you enable it as per Azure Data Security and Encryption Best Practices)

2. Protecting access to VM itself and it's resources - which is taken care of by RBAC.

When you Disable Disk Encryption

It does actually make sure that currently encrypted data gets decrypted back and is no longer encrypted at rest.

Since Azure already knows the details about the Key Encryption Key (KEK) and Disk Encryption Key (DEK) details from the time you enable the encryption in first place, it doesn't really need to ask back for these details in order to decrypt the currently encrypted information.

Here are the details of decryption flow from Microsoft Docs:

Decryption workflow

How can the disks be safeguarded from disabling encryption, through RBAC ?

The real concern of who can manage VM in general or initiate/disable Disk Encryption can be controlled by assigning (or removing) the correct roles like Owner or Virtual Machine Contributor using RBAC from Azure Portal/PowerShell etc.