π‘οΈ Azure Managed HSM diagnostic logging is not enabledπ’βͺ
- Contextual name: π‘οΈ Managed HSM diagnostic logging is not enabledπ’βͺ
- ID:
/ce/ca/azure/managed-hsm/diagnostic-logging - Tags:
- βͺ Impossible policy
- π’ Policy with categories
- π’ Policy with type
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Statsβ
not available
Descriptionβ
Descriptionβ
A Managed HSM keeps its AuditEvent resource log, the record of authenticated requests and key operations, only when a diagnostic setting sends that log category to a Log Analytics workspace, storage account, or event hub.
Rationaleβ
Without a diagnostic setting, the HSM's key operations, local role assignment changes, and security domain downloads leave no retained record. Misuse of a key, an over- broad role assignment, or a security domain export by an insider then cannot be detected or attributed, for the keys that protect an estate's most sensitive data.
Auditβ
This requirement needs manual assessment. Managed HSM resources and their audit diagnostic settings are not collected.
Remediationβ
Remediationβ
A Managed HSM keeps its AuditEvent resource log, the record of authenticated requests and key operations, only when a diagnostic setting sends that log category to a Log Analytics workspace, storage account, or event hub.
On the Managed HSM, open Monitoring > Diagnostic settings. Add or edit a setting, enable the audit category group or AuditEvent category, select at least one approved destination, and save. Preserve existing log categories and destinations when editing a setting. Verify that audit events reach the destination.
Automated assessment is unavailable: Managed HSM resources and their audit diagnostic settings are not collected.
policy.yamlβ
Linked Framework Sectionsβ
| Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
|---|---|---|---|---|---|
| πΌ CIS Azure v7.0.0 β πΌ 8.3.1.2 Ensure that Logging for Azure Key Vault Managed HSM is 'Enabled' (Automated) | 1 | no data | |||
| πΌ Cloudaware Framework β πΌ Logging and Monitoring Configuration | 82 | no data |