🛡️ Azure Key Vault Public Network Access is enabled🟢

• Contextual name: 🛡️ Public Network Access is enabled🟢
• ID: /ce/ca/azure/key-vault/public-network-access
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Key Vault
  • 🔌 Azure Key Vault - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• Internal: dec-x-d8ad91bf

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-d8ad91bf	1

Description

Open File

Description

This policy identifies Azure Key Vaults where public network access is not disabled, which increases exposure to the internet and the risk of unauthorized access. Access to Azure Key Vault should be restricted to trusted networks using private endpoints.

Disabling public network access removes the Key Vault’s public endpoint from Azure public DNS. With a private endpoint in place, all traffic is routed through the private endpoint using the private DNS name (mykeyvault.vault.privatelink.azure.net), ensuring access occurs only within trusted network boundaries.

When a private endpoint is configured for a Key Vault, Azure resources within the associated virtual network connect to the vault using a private IP address. However, unless public network access is explicitly disabled, the Key Vault remains reachable via its public endpoint (mykeyvault.vault.azure.net) over the internet.

Rationale

Disabling public network access improves security by ensuring that a service is not exposed on the public internet.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Key Vaults.
2. Click the name of a Key Vault.
3. Under Settings, click Networking.
4. Under Firewalls and virtual networks, next to Allow access from:, click the radio button next to Disable public access.
5. Click Apply.
6. Repeat steps 1-5 for each Key Vault requiring remediation.

From Azure CLI

For each Key Vault requiring remediation, run the following command to disable public network access:

az keyvault update \
    --resource-group {{resource-group-name}} \
    --name {{key-vault-name}} \
    --public-network-access Disabled

From PowerShell

For each Key Vault requiring remediation, run the following command to disable public network access:

Update-AzKeyVault `
    -ResourceGroupName {{resource-group-name}} `
    -VaultName {{key-vault-name}} `
    -PublicNetworkAccess "Disabled"

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 APRA CPG 234 → 💼 36f network design — to ensure authorised network traffic flows and to reduce the impact of security compromises;		76	107		no data
💼 APRA CPG 234 → 💼 45 An understanding of plausible worst case scenarios can help regulated entities identify and implement additional controls to prevent or reduce the impact of such scenarios. One example is malware that infects computers and encrypts data, both on the infected computer and any connected storage, including (corporate) networks and cloud storage. Such attacks reinforce the importance of protecting the backup environment in the event that the production environment is compromised. Common techniques to achieve this include network segmentation, highly restricted and segregated access controls and network traffic flow restrictions.		83	115		no data
💼 CIS Azure v5.0.0 → 💼 8.3.7 Ensure Public Network Access is Disabled (Automated)			1		no data
💼 CIS Azure v6.0.0 → 💼 8.3.7 Ensure Public Network Access is Disabled (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			137		no data
💼 FedRAMP High Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)		18	141		no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4(21) Physical or Logical Separation of Information Flows (M)(H)			141		no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows		83	141		no data
💼 UK Cyber Essentials → 💼 1.2 Prevent access to the administrative interface from the internet		85	119		no data