🛡️ Azure Managed HSM does not use private endpoints🟢⚪

• Contextual name: 🛡️ Managed HSM does not use private endpoints🟢⚪
• ID: /ce/ca/azure/managed-hsm/private-endpoints
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

A Managed HSM is reached through its public endpoint or through private endpoints that connect a virtual network to it over Azure Private Link. Each private endpoint connection is Pending, Approved, Rejected, or Disconnected, and only an Approved connection carries traffic.

Rationale

Without a private endpoint, every client reaches the HSM's data plane over its public endpoint, so public network access cannot be disabled without cutting off every client; Managed HSM supports no virtual network service endpoints as an alternative. Key operations then cross public networks to an endpoint that any internet address can reach and probe.

Audit

This requirement needs manual assessment. Managed HSM resources and approved private endpoint connections are not collected.

Remediation

Open File

Remediation

A Managed HSM is reached through its public endpoint or through private endpoints that connect a virtual network to it over Azure Private Link. Each private endpoint connection is Pending, Approved, Rejected, or Disconnected, and only an Approved connection carries traffic.

Create a private endpoint targeting the Managed HSM and approve its connection. Configure the private DNS zone privatelink.managedhsm.azure.net with the HSM record and link it to the client virtual network. Verify private DNS resolution and a successful HSM connection from each required client network.

Automated assessment is unavailable: Managed HSM resources and approved private endpoint connections are not collected.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 8.3.1.6 Ensure Private Endpoints are Used to Access Azure Key Vault Managed HSM (Automated)			1		no data
💼 Cloudaware Framework → 💼 Secure Access			63		no data