rules/findings/azure/keyvault/azure-keyvault-public-network-access-enabled.json
|
{
"provider": "Azure", "serviceType": "Azure KeyVault", "serviceName": "Storage", "displayName": "Ensure Public Network Access is Disabled", "description": "Disable public network access to prevent exposure to the internet and reduce the risk of unauthorized access. Use private endpoints to securely manage access within trusted networks.<br/><br/>When a private endpoint is configured on a key vault, connections from Azure resources within the same subnet will use its private IP address. However, network traffic from the public internet can still connect to the key vault's public endpoint (mykeyvault.vault.azure.net) using its public IP address unless public network access is disabled.<br/><br/>Disabling public network access removes the vault's public endpoint from Azure public DNS, reducing its exposure to the public internet. With a private endpoint configured, network traffic will use the vault's private endpoint IP address for all requests (mykeyvault.vault.privatelink.azure.net).", "rationale": "Disabling public network access improves security by ensuring that a service is not exposed on the public internet.<br/><br/>Removing a point of interconnection from the internet edge to your key vault can strengthen the network security boundary of your system and reduce the risk of exposing the control plane or vault objects to untrusted clients.<br/><br/>Although Azure resources are never truly isolated from the public internet, disabling the public endpoint removes a line of sight from the public internet and increases the effort required for an attack.", "impact": "NOTE: Prior to disabling public network access, it is strongly recommended that, for each key vault, either:\n• virtual network integration is completed OR\n• private endpoints/links are set up as described in \"Ensure Private Endpoints are used to access Azure Key Vault.\" Disabling public network access restricts access to the service. This enhances security but will require the configuration of a virtual network and/or private endpoints for any services or users needing access within trusted networks.", "remediation": { "text": "Remediate from Azure Portal 1. Go to Key vaults. 2. Click the name of a key vault. 3. Under Settings, click Networking. 4. Under Firewalls and virtual networks, next to Allow access from:, click the radio button next to Disable public access. 5. Click Apply. 6. Repeat steps 1-5 for each key vault requiring remediation. Remediate from Azure CLI For each key vault requiring remediation, run the following command to disable public network access:", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/key-vault/general/network-security?tabs=azure-portal", "https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.3.7", "profile": [ "Level 1" ] } ], "level": "low", "tags": [], "rule": { "path": "az_keyvault", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "networking.publicNetworkAccess", "ne", "Disabled" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "id": "id", "name": "name", "location": "Location", "networking.publicNetworkAccess": "Public Network Access" }, "expandObject": null }, "table": "default", "decorate": [ { "itemName": "Public Network Access", "itemValue": "enabled", "className": "badge badge-danger badge-xl" } ], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "networking" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "id": "id", "name": "name", "location": "Location", "networking.publicNetworkAccess": "Public Network Access" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure Public Network Access is Disabled for {name} Key Vault", "defaultMessage": "Ensure Public Network Access is Disabled" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureKeyVault" }, "onlyStatus": false } }, "idSuffix": "azure_key_vault_public_network_access_enabled", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "azure_keyvault_007" } |