🛡️ Azure Key Vault default network access is not restricted🟢

• Contextual name: 🛡️ Key Vault default network access is not restricted🟢
• ID: /ce/ca/azure/key-vault/deny-default-network-access
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Key Vault
  • 🔌 Azure Key Vault - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

A key vault accepts data-plane connections from all networks, only from allowed virtual networks and IP addresses, or only through private endpoints. The Allow access from setting selects between Allow public access from all networks, Allow public access from specific virtual networks and IP addresses, and Disable public access. Prerequisites: Add a virtual network rule, an IP address rule, or a private endpoint for every client that needs data-plane access before setting the default action to deny.

Rationale

With the default network access rule set to allow, the vault's data plane accepts connections from any internet address, and its virtual network and IP address rules have no effect, so the vault can appear network-restricted while it is not. A leaked token or a misassigned role can then be used against its keys, secrets, and certificates from anywhere.

Audit

This policy marks an Azure Key Vault as INCOMPLIANT if public network access is Enabled or unset and Network Rule Set Default Action is Allow or unset.

... see more

Remediation

Open File

Remediation

Before restricting the vault, add permitted virtual networks, IP rules, or private endpoints for every required client. Test private DNS and access from application and administrative networks.

In Key vaults > Networking, allow access from specific virtual networks and IP addresses, or disable public access. To change only the default firewall action:

az keyvault update --resource-group {{resource-group}} --name {{vault-name}} --default-action Deny

Retain existing allow rules and required trusted-service exceptions. Verify the resulting default action and test required data-plane operations. Unexpected loss of access requires reviewing the allow rules or restoring the prior default action while repairing connectivity.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.3.10 Ensure the Default Network Access Rule for Key Vaults is Set to Deny (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			144		no data