[Rule] Encrypt sensitive fields using Always Encrypted / client-side encryption

[sajeetharan]

For compliance-sensitive workloads (PII, financial data), Cosmos DB supports client-side encryption (Always Encrypted). Developers often store sensitive data in plaintext without realizing this option exists.

We need a rule covering:

• When to use: PII, healthcare, finance, regulatory compliance
• Client-side encryption setup with Azure Key Vault
• Performance considerations (encrypted fields can't be indexed/queried)
• Difference from encryption-at-rest (which is always on)

Category: \security-\ Security
Impact: Medium
Suggested file: \skills/cosmosdb-best-practices/rules/security-client-encryption.md\

References:

• https://learn.microsoft.com/azure/cosmos-db/nosql/how-to-always-encrypted

---

This is a good first issue! Follow the Contributing Guide and use the rule template to get started.

[ramnnn2006]

hey @sajeetharan , can i take on this one? i'm already working on #174 so the rule format is fresh.
my plan is to add security-client-encryption.md covering when client side encryption makes sense (PII, healthcare, finance), the Key Vault setup, the catch that encrypted fields can't be indexed or queried, and how it differs from the encryption at rest that's already on by default.
pls assign it to me , i will start working on it in the meanwhile...lmk if i shd change my approach.

[ramnnn2006]

i've raised the pr. check and let me know if any changes r reqired.