π‘οΈ Azure Key Vault Premium keys are not HSM-protectedπ’βͺ
- Contextual name: π‘οΈ Key Vault Premium keys are not HSM-protectedπ’βͺ
- ID:
/ce/ca/azure/key-vault/premium-keys-hsm-protected - Tags:
- βͺ Impossible policy
- π’ Policy with categories
- π’ Policy with type
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Statsβ
not available
Descriptionβ
Descriptionβ
A key in a Premium-tier key vault is software-protected, with key type RSA or EC, or HSM-protected, with key type RSA-HSM, EC-HSM, or oct-HSM. The key type chosen when each key is created selects between them. Keys that back certificates follow the certificate's key type and are out of scope.
Rationaleβ
Key Vault Premium accepts software-protected keys beside HSM-protected ones, and a software-protected key carries FIPS 140-2 Level 1 validation rather than the FIPS 140-3 Level 3 of HSM-protected key versions on HSM Platform 2. A vault chosen for HSM protection can therefore hold keys protected only to FIPS 140-2 Level 1, short of what a hardware key protection requirement demands.
Auditβ
This requirement needs manual assessment. The key cryptographic type (RSA-HSM or EC-HSM) is not collected; vault SKU alone cannot establish hardware protection of each key.
Remediationβ
Remediationβ
A key in a Premium-tier key vault is software-protected, with key type RSA or EC, or HSM-protected, with key type RSA-HSM, EC-HSM, or oct-HSM. The key type chosen when each key is created selects between them. Keys that back certificates follow the certificate's key type and are out of scope.
Create HSM-protected replacement keys using RSA-HSM or EC-HSM with the required key size or curve. Migrate dependent workloads to the replacement keys and verify their operation. Disable each software-protected key only after all dependent workloads and retained data have been migrated and verified.
Retain access to keys required to decrypt existing data throughout the migration.
Automated assessment is unavailable: The key cryptographic type (RSA-HSM or EC-HSM) is not collected; vault SKU alone cannot establish hardware protection of each key.
policy.yamlβ
Linked Framework Sectionsβ
| Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
|---|---|---|---|---|---|
| πΌ CIS Azure v7.0.0 β πΌ 8.3.1.3 Ensure Keys in Azure Key Vault Premium are HSM-Protected (Automated) | 1 | no data | |||
| πΌ Cloudaware Framework β πΌ Cryptographic Configuration | 20 | no data |