Skip to main content

📝 Azure App Service does not use Azure Key Vaults to store secrets 🟢

  • Contextual name: 📝 App Service does not use Azure Key Vaults to store secrets 🟢
  • ID: /ce/ca/azure/app-service/use-key-vaults-to-store-secrets
  • Located in: 📁 Azure App Service

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Description​

Open File

Description​

Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.

Rationale​

The credentials given to an application have permissions to create, delete, or modify data stored within the systems they access. If these credentials are stored within the application itself, anyone with access to the application or a copy of the code has access to them. Storing within Azure Key Vault as secrets increases security by controlling access. This also allows for updates of the credentials without redeploying the entire application.

Impact​

Integrating references to secrets within the key vault are required to be specifically integrated within the application code. This will require additional configuration to be made during the writing of an application, or refactoring of an already written one. There are also additional costs that are charged per 10000 requests to the Key Vault.

... see more

Remediation​

Open File

Remediation​

Remediation has 2 steps

  1. Setup the Key Vault.
  2. Setup the App Service to use the Key Vault.

Step 1: Set up the Key Vault​

From Azure CLI​
az keyvault create --name "<name>" --resource-group "<myResourceGroup>" --location myLocation
From Powershell​
New-AzKeyvault -name <name> -ResourceGroupName <myResourceGroup> -Location <myLocation>

Step 2: Set up the App Service to use the Key Vault​

Sample JSON Template for App Service Configuration:

{ 
    //... 
    "resources": [ 
        { 
            "type": "Microsoft.Storage/storageAccounts", 
            "name": "[variables('storageAccountName')]", 
            //... 
        }, 
        { 
            "type": "Microsoft.Insights/components", 
            "name": "[variables('appInsightsName')]", 
            //... 
        }, 
        { 
            "type": "Microsoft.Web/sites", 
            "name": "[variables('functionAppName')]", 
            "identity": { 
                "type": "SystemAssigned" }, 
                //... 
            "resources": [

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 9.10 Ensure Azure Key Vaults are Used to Store Secrets - Level 2 (Manual)1
💼 CIS Azure v3.0.0 → 💼 9.11 Ensure Azure Key Vaults are Used to Store Secrets (Manual)1
💼 Cloudaware Framework → 💼 Data Encryption31