🛡️ Azure Key Vault Public Network Access is enabled🟢

• Contextual name: 🛡️ Public Network Access is enabled🟢
• ID: /ce/ca/azure/key-vault/public-network-access
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Key Vault
  • 🔌 Azure Key Vault - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies Azure Key Vaults where public network access is not disabled to reduce exposure to the internet and minimize the risk of unauthorized access. Access to Azure Key Vault should be restricted to trusted networks using private endpoints.

Disabling public network access removes the key vault’s public endpoint from Azure public DNS. With a private endpoint in place, all traffic is routed through the private endpoint using the private DNS name (mykeyvault.vault.privatelink.azure.net), ensuring access occurs only within trusted network boundaries.

When a private endpoint is configured for a key vault, Azure resources within the associated virtual network connect to the vault using a private IP address. However, unless public network access is explicitly disabled, the key vault remains reachable via its public endpoint (mykeyvault.vault.azure.net) over the internet.

Rationale

Disabling public network access improves security by ensuring that a service is not exposed on the public internet.

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Key vaults.
2. Click the name of a key vault.
3. Under Settings, click Networking.
4. Under Firewalls and virtual networks, next to Allow access from:, click the radio button next to Disable public access.
5. Click Apply.
6. Repeat steps 1-5 for each key vault requiring remediation.

From Azure CLI

For each key vault requiring remediation, run the following command to disable public network access:

az keyvault update --resource-group <resource-group> --name <key-vault> --public-network-access Disabled

From PowerShell

For each key vault requiring remediation, run the following command to disable public network access:

Update-AzKeyVault -ResourceGroupName <resource-group> -VaultName <vault-name> -PublicNetworkAccess "Disabled"

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v5.0.0 → 💼 8.3.7 Ensure Public Network Access is Disabled (Automated)			1		no data
💼 Cloudaware Framework → 💼 Secure Access			68		no data