📝 Azure Key Vault Soft Delete and Purge Protection functions are not enabled 🟢

• Contextual name: 📝 Soft Delete and Purge Protection functions are not enabled 🟢
• ID: /ce/ca/azure/key-vault/soft-delete-and-purge-protection
• Located in: 📁 Azure Key Vault

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Enable Key Vault Recoverability
• Internal
  • dec-x-0be4dfe5

Similar Internal Rules

Rule	Policies	Flags
✉️ dec-x-0be4dfe5	1

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Azure Key Vault
  • 🔌 Azure Key Vault - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

The Key Vault contains object keys, secrets, and certificates. Accidental unavailability of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects.

It is recommended the Key Vault be made recoverable by enabling the "Do Not Purge" and "Soft Delete" functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.

NOTE: In February 2025, Microsoft will enable soft-delete protection on all key vaults, and users will no longer be able to opt out of or turn off soft-delete.

WARNING: A current limitation is that role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.

Rationale

There could be scenarios where users accidentally run delete/purge commands on Key Vault or an attacker/malicious user deliberately does so in order to cause disruption. Deleting or purging a Key Vault leads to immediate data loss, as keys encrypting data and secrets/certificates allowing access/services will become non-accessible.

... see more

Remediation

Open File

Remediation

To enable Do Not Purge and Soft Delete for a Key Vault:

From Azure Portal

1. Go to Key Vaults.

2. For each Key Vault.

3. Click Properties.

4. Ensure the status of Purge protection reads Enable purge protection (enforce a mandatory retention period for deleted vaults and vault objects).

   Note: once enabled you cannot disable it.

5. Click Save.

6. Repeat steps 1-5 for each Key Vault requiring remediation.

From Azure CLI

az resource update --id /subscriptions/xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/<resourceGroupName>/providers/Microsoft.KeyVault /vaults/<keyVaultName> --set properties.enablePurgeProtection=true

From PowerShell

Update-AzKeyVault -VaultName <vaultName> -ResourceGroupName <resourceGroupName> -EnablePurgeProtection

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS Azure v1.1.0 → 💼 8.4 Ensure the key vault is recoverable		1	1
💼 CIS Azure v2.1.0 → 💼 8.5 Ensure the Key Vault is Recoverable - Level 1 (Automated)		1	1
💼 CIS Azure v3.0.0 → 💼 3.3.5 Ensure the Key Vault is Recoverable (Automated)			1
💼 CIS Azure v4.0.0 → 💼 9.3.5 Ensure the Key Vault is Recoverable (Automated)			1
💼 Cloudaware Framework → 💼 Data Protection and Recovery			16
💼 FedRAMP High Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	6	14	32
💼 FedRAMP High Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)	1	9	11
💼 FedRAMP Low Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	1		32
💼 FedRAMP Low Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 FedRAMP Moderate Security Controls → 💼 IA-5 Authenticator Management (L)(M)(H)	4		32
💼 FedRAMP Moderate Security Controls → 💼 SC-12 Cryptographic Key Establishment and Management (L)(M)(H)			11
💼 ISO/IEC 27001:2013 → 💼 A.9.2.4 Management of secret authentication information of users		8	10
💼 ISO/IEC 27001:2013 → 💼 A.10.1.2 Key management		9	11
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes		19	30
💼 NIST CSF v1.1 → 💼 PR.AC-7: Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals' security and privacy risks and other organizational risks)		19	23
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected		15	28
💼 NIST CSF v1.1 → 💼 PR.DS-2: Data-in-transit is protected		16	31
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization			38
💼 NIST CSF v2.0 → 💼 PR.AA-03: Users, services, and hardware are authenticated			32
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties			88
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected			114
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected			94
💼 SOC 2 → 💼 CC6.1-11 Protects Encryption Keys		6	9