rules/findings/azure/keyvault/azure-keyvault-purge-protection-not-enabled.json
|
{
"provider": "Azure", "serviceType": "Azure KeyVault", "serviceName": "Storage", "displayName": "Ensure 'Purge protection' is set to 'Enabled'", "description": "Key vaults contain object keys, secrets, and certificates. Deletion of a key vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the key vault objects.<br/><br/>It is recommended the key vault be made recoverable by enabling the \"purge protection\" function. This is to prevent the loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by key vault objects (keys, secrets, certificates, etc.).<br/><br/>NOTE: In February 2025, Microsoft enabled soft delete protection on all key vaults.<br/><br/>Users can no longer opt out of or turn off soft delete.<br/><br/>WARNING: A current limitation is that role assignments disappear when a key vault is deleted. All role assignments will need to be recreated after recovery.", "rationale": "Users may accidentally run delete/purge commands on a key vault, or an attacker or malicious user may do so deliberately in order to cause disruption. Deleting or purging a key vault leads to immediate data loss, as keys encrypting data and secrets/certificates allowing access/services will become inaccessible.<br/><br/>Enabling purge protection ensures that even if a key vault is deleted, the key vault and its objects remain recoverable during the configurable retention period. If no action is taken, the key vault and its objects will be purged once the retention period elapses.", "impact": "Once purge protection is enabled for a key vault, it cannot be disabled.", "remediation": { "text": "Note: Once enabled, purge protection cannot be disabled. Remediate from Azure Portal 1. Go to Key Vaults. 2. Click the name of a key vault. 3. Under Settings, click Properties. 4. Select the radio button next to Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects). 5. Click Save. 6. Repeat steps 1-5 for each key vault requiring remediation.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-recovery?tabs=azure-portal", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-8-ensure-security-of-key-and-certificate-repository" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.3.5", "profile": [ "Level 1" ] } ], "level": "low", "tags": [], "rule": { "path": "az_keyvault", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "properties.enablePurgeProtection", "eq", "false" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Key Vault Name", "location": "Location", "properties.enablePurgeProtection": "Purge Protection Enabled" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "properties" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Key Vault Name", "location": "Location", "properties.enablePurgeProtection": "Purge Protection Enabled" }, "expandObject": null }, "status": { "keyName": ["name"], "message": "Ensure 'Purge protection' is set to 'Enabled' for {name}", "defaultMessage": "Ensure 'Purge protection' is set to 'Enabled'" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureKeyVault" }, "onlyStatus": false } }, "idSuffix": "azure_key_vault_purge_protection_disabled", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "azure_keyvault_005" } |