🛡️ Azure App Service does not use Azure Key Vaults to store secrets🟢⚪

• Contextual name: 🛡️ App Service does not use Azure Key Vaults to store secrets🟢⚪
• ID: /ce/ca/azure/app-service/use-key-vaults-to-store-secrets
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Similar Policies

• Cloud Conformity: Use Key Vaults to Store App Service Application Secrets

Description

Open File

Description

Azure Key Vault stores multiple types of sensitive information such as encryption keys, certificate thumbprints, and managed identity credentials. Access to these secrets can be controlled through granular permissions.

Rationale

The credentials given to an application have permissions to create, delete, or modify data stored within the systems they access. If these credentials are stored within the application itself, anyone with access to the application or a copy of the code has access to them. Storing them in Azure Key Vault as secrets increases security by controlling access. This also allows credential updates without redeploying the entire application.

Impact

References to Key Vault secrets must be integrated into the application code. This requires additional configuration during application development or refactoring of an existing application. There are also additional costs charged per 10,000 requests to Key Vault.

Audit

From Azure Portal

1. Log in to the Azure portal.
2. In the left navigation pane, go to Key Vaults.

... see more

Remediation

Open File

Remediation

Remediation has two steps.

1. Set up the Key Vault.
2. Set up the App Service to use the Key Vault.

Step 1: Set up the Key Vault

From Azure CLI

az keyvault create \
    --name {{key-vault-name}} \
    --resource-group {{resource-group-name}} \
    --location {{location}}

From PowerShell

New-AzKeyVault `
    -Name {{key-vault-name}} `
    -ResourceGroupName {{resource-group-name}} `
    -Location {{location}}

Step 2: Set up the App Service to use the Key Vault

Sample JSON Template for App Service Configuration:

{ 
    //... 
    "resources": [ 
        { 
            "type": "Microsoft.Storage/storageAccounts", 
            "name": "[variables('storageAccountName')]", 
            //... 
        }, 
        { 
            "type": "Microsoft.Insights/components", 
            "name": "[variables('appInsightsName')]", 
            //... 
        }, 
        { 
            "type": "Microsoft.Web/sites", 
            "name": "[variables('functionAppName')]", 
            "identity": { 
                "type": "SystemAssigned" }, 

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v2.1.0 → 💼 9.10 Ensure Azure Key Vaults are Used to Store Secrets - Level 2 (Manual)			1		no data
💼 CIS Azure v3.0.0 → 💼 9.11 Ensure Azure Key Vaults are Used to Store Secrets (Manual)			1		no data
💼 Cloudaware Framework → 💼 Data Encryption			61		no data