π‘οΈ Azure Managed HSM public network access is not disabledπ’βͺ
- Contextual name: π‘οΈ Managed HSM public network access is not disabledπ’βͺ
- ID:
/ce/ca/azure/managed-hsm/public-network-access - Tags:
- βͺ Impossible policy
- π’ Policy with categories
- π’ Policy with type
- Policy Type:
COMPLIANCE_POLICY - Policy Categories:
SECURITY
Statsβ
not available
Descriptionβ
Descriptionβ
A Managed HSM accepts data-plane connections from public networks, or only through private endpoints and trusted Microsoft services. The Public network access setting, Enabled or Disabled, selects between them. Prerequisites: Give every client that needs data-plane access an approved private endpoint with private DNS resolution before disabling public network access.
Rationaleβ
With public network access enabled, the HSM's data-plane endpoint is reachable from the internet, limited at most by an IP address allowlist and guarded otherwise only by Microsoft Entra authentication and local role assignments. A stolen token or an over- broad role assignment can then be used from anywhere to run cryptographic operations with the HSM's keys.
Auditβ
This requirement needs manual assessment. Managed HSM resources and publicNetworkAccess are not collected.
Remediationβ
Remediationβ
A Managed HSM accepts data-plane connections from public networks, or only through private endpoints and trusted Microsoft services. The Public network access setting, Enabled or Disabled, selects between them. Prerequisites: Give every client that needs data-plane access an approved private endpoint with private DNS resolution before disabling public network access.
On the Managed HSM, open Settings > Networking > Public access and set Public network access to Disabled. Save the change, confirm that public connections are blocked, and verify that required clients can still connect through their approved private endpoints.
Automated assessment is unavailable: Managed HSM resources and publicNetworkAccess are not collected.
policy.yamlβ
Linked Framework Sectionsβ
| Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
|---|---|---|---|---|---|
| πΌ CIS Azure v7.0.0 β πΌ 8.3.1.5 Ensure 'Public Network Access' is 'Disabled' for Azure Key Vault Managed HSM (Automated) | 1 | no data | |||
| πΌ Cloudaware Framework β πΌ Network Exposure | 144 | no data |