rules/findings/azure/databases/redis/azure-cache-redis-entra-auth-disabled.json
|
{
"provider": "Azure", "serviceType": "Cache for Redis", "serviceName": "Databases", "displayName": "Ensure \u0027Microsoft Entra Authentication\u0027 is \u0027Enabled\u0027", "description": "Ensuring that Microsoft Entra Authentication is \u0060Enabled\u0060 provides a natively integrated use of identities already defined with Microsoft Entra ID.", "rationale": "The use of a centralized Identity and Access Management (IAM) solution such as Microsoft Entra ID is highly recommended for all activity related to Identity, Authentication, Authorization, and Accountability.\u003Cbr/\u003E\u003Cbr/\u003EDecentralized IAM \u2013 such as local authentication methods \u2013 may present additional vulnerability and introduce avoidable administrative complexity.", "impact": "Free tiers exist for the licensing of Microsoft Entra ID if required.", "remediation": { "text": "\n\t\t\t##### Remediate From Azure Portal \n\t\t\t1. Search for and open the Azure Cache for Redis service \n\t\t\t2. For each instance, repeat the remaining steps \n\t\t\t3. Click on the name of the instance \n\t\t\t4. In the blade menu on the left, click on Authentication \n\t\t\t5. Check the checkbox next to Enable Microsoft Entra Authentication\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management", "https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-azure-active-directory-for-authentication" ], "compliance": [ { "name": "CIS Microsoft Azure Database Services", "version": "2.0.0", "reference": "2.1", "profile": [ "Level 1" ] } ], "level": "low", "tags": [], "rule": { "path": "az_redis", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "properties.redisConfiguration.\u0027aad-enabled\u0027", "ne", "true" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Name", "location": "location", "resourceGroupName": "Resource Group Name", "properties.redisConfiguration.\u0027aad-enabled\u0027": "Entra Authentication Enabled" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "location", "properties.redisConfiguration" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Name", "location": "location", "resourceGroupName": "Resource Group Name", "properties.redisConfiguration.\u0027aad-enabled\u0027": "Entra Authentication Enabled" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure \u0027Microsoft Entra Authentication\u0027 is \u0027Enabled\u0027 for {name}", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "cache_redis_entra_auth_disabled", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "azure_redis_011" } |