rules/findings/azure/keyvault/azure-keyvault-purge-protection-not-enabled.json
|
{
"provider": "Azure", "serviceType": "Azure KeyVault", "serviceName": "Storage", "displayName": "Ensure \u0027Purge protection\u0027 is set to \u0027Enabled\u0027", "description": "Key vaults contain object keys, secrets, and certificates. Deletion of a key vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the key vault objects.\u003Cbr/\u003E\u003Cbr/\u003EIt is recommended the key vault be made recoverable by enabling the \u0022purge protection\u0022 function. This is to prevent the loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by key vault objects (keys, secrets, certificates, etc.).\u003Cbr/\u003E\u003Cbr/\u003ENOTE: In February 2025, Microsoft enabled soft delete protection on all key vaults.\u003Cbr/\u003E\u003Cbr/\u003EUsers can no longer opt out of or turn off soft delete.\u003Cbr/\u003E\u003Cbr/\u003EWARNING: A current limitation is that role assignments disappear when a key vault is deleted. All role assignments will need to be recreated after recovery.", "rationale": "Users may accidentally run delete/purge commands on a key vault, or an attacker or malicious user may do so deliberately in order to cause disruption. Deleting or purging a key vault leads to immediate data loss, as keys encrypting data and secrets/certificates allowing access/services will become inaccessible.\u003Cbr/\u003E\u003Cbr/\u003EEnabling purge protection ensures that even if a key vault is deleted, the key vault and its objects remain recoverable during the configurable retention period. If no action is taken, the key vault and its objects will be purged once the retention period elapses.", "impact": "Once purge protection is enabled for a key vault, it cannot be disabled.", "remediation": { "text": "Note: Once enabled, purge protection cannot be disabled. Remediate from Azure Portal 1. Go to Key Vaults. 2. Click the name of a key vault. 3. Under Settings, click Properties. 4. Select the radio button next to Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects). 5. Click Save. 6. Repeat steps 1-5 for each key vault requiring remediation.", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/key-vault/general/key-vault-recovery?tabs=azure-portal", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-8-ensure-security-of-key-and-certificate-repository" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.3.5", "profile": [ "Level 1" ] } ], "level": "low", "tags": [], "rule": { "path": "az_keyvault", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "properties.enablePurgeProtection", "eq", "false" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Key Vault Name", "location": "Location", "properties.enablePurgeProtection": "Purge Protection Enabled" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "properties" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Key Vault Name", "location": "Location", "properties.enablePurgeProtection": "Purge Protection Enabled" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure \u0027Purge protection\u0027 is set to \u0027Enabled\u0027 for {name}", "defaultMessage": "Ensure \u0027Purge protection\u0027 is set to \u0027Enabled\u0027" }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "AzureKeyVault" }, "onlyStatus": false } }, "idSuffix": "azure_key_vault_purge_protection_disabled", "notes": [], "categories": [], "immutableProperties": [ "id" ], "id": "azure_keyvault_005" } |