Skip to main content

🛡️ Azure Diagnostic Setting for Azure Key Vault is not enabled🟢⚪

  • Contextual name: 🛡️ Diagnostic Setting for Azure Key Vault is not enabled🟢⚪
  • ID: /ce/ca/azure/monitor/diagnostic-setting-for-azure-key-vault
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-b2ce0ca11

Description​

Open File

Description​

Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available.

Rationale​

Monitoring how and when key vaults are accessed, and by whom, enables an audit trail of interactions with confidential information, keys, and certificates managed by Azure Key Vault. Enabling logging for Key Vault saves information in a user provided destination of either an Azure storage account or Log Analytics workspace. The same destination can be used for collecting logs for multiple Key Vaults.

Audit​

From Azure Portal​
  1. Go to Key vaults.
  2. For each Key vault, under Monitoring, go to Diagnostic settings.
  3. Click Edit setting next to a diagnostic setting.
  4. Ensure that a destination is configured.
  5. Under Category groups, ensure that audit and allLogs are checked.
From Azure CLI​

List all key vaults:

az keyvault list

For each keyvault id:

az monitor diagnostic-settings list --resource <id>

Ensure that storageAccountId reflects your desired destination and that categoryGroup and enabled are set as follows in the sample outputs below:

... see more

Remediation​

Open File

Remediation​

From Azure Portal​

  1. Go to Key vaults.
  2. Select a Key vault.
  3. Select Diagnostic settings.
  4. Click Edit setting to update an existing diagnostic setting, or Add diagnostic setting to create a new one.
  5. If creating a new diagnostic setting, provide a name.
  6. Configure an appropriate destination.
  7. Under Category groups, check audit and allLogs.
  8. Click Save.

From Azure CLI​

To update an existing Diagnostic Settings:

az monitor diagnostic-settings update --name "<diagnostic_setting_name>" --resource <key_vault_id>

To create a new Diagnostic Settings:

az monitor diagnostic-settings create --name "<diagnostic_setting_name>" --resource <key_vault_id> --logs "[{category:audit,enabled:true},{category:allLogs,enabled:true}]" --metrics "[{category:AllMetrics,enabled:true}]" --event-hub <event_hub_ID> --event-hub-rule <event_hub_auth_rule_ID> | --storage-account <storage_account_ID> |--workspace <log_analytics_workspace_ID> | --marketplace-partner-id <solution_resource_ID>

From PowerShell​

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;1922no data
💼 APRA CPG 234 → 💼 h. audit logging and monitoring of access to information assets by all users;89no data
💼 CIS Azure v1.1.0 → 💼 5.1.7 Ensure that logging for Azure KeyVault is 'Enabled'11no data
💼 CIS Azure v1.3.0 → 💼 5.1.5 Ensure that logging for Azure KeyVault is 'Enabled' - Level 1 (Automated)11no data
💼 CIS Azure v1.4.0 → 💼 5.1.5 Ensure that logging for Azure KeyVault is 'Enabled' - Level 1 (Automated)11no data
💼 CIS Azure v1.5.0 → 💼 5.1.5 Ensure that logging for Azure Key Vault is 'Enabled' - Level 1 (Automated)11no data
💼 CIS Azure v2.0.0 → 💼 5.1.5 Ensure that logging for Azure Key Vault is 'Enabled' - Level 1 (Automated)11no data
💼 CIS Azure v2.1.0 → 💼 5.1.4 Ensure that logging for Azure Key Vault is 'Enabled' - Level 1 (Automated)11no data
💼 CIS Azure v3.0.0 → 💼 6.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (Automated)1no data
💼 CIS Azure v4.0.0 → 💼 7.1.1.4 Ensure that logging for Azure Key Vault is 'Enabled' (Automated)1no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration65no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)726no data
💼 FedRAMP High Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)14no data
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62032no data
💼 FedRAMP High Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)3811no data
💼 FedRAMP High Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)1618no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)265no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)425no data
💼 FedRAMP High Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)78no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4851no data
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)24no data
💼 FedRAMP Low Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)10no data
💼 FedRAMP Low Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)18no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)26no data
💼 FedRAMP Moderate Security Controls → 💼 AU-3(1) Additional Audit Information (M)(H)14no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)232no data
💼 FedRAMP Moderate Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)110no data
💼 FedRAMP Moderate Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)18no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)219no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)8no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.1 Event logging1518no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.3 Administrator and operator logs78no data
💼 ISO/IEC 27001:2022 → 💼 5.28 Collection of evidence1421no data
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging1834no data
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1824no data
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors1838no data
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events1863no data
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2026no data
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed1824no data
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated2933no data
💼 NIST CSF v1.1 → 💼 ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations1519no data
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1633no data
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated1824no data
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria1922no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities35no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources50no data
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools33no data
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis38no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events145no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events85no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events35no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events142no data
💼 NIST CSF v2.0 → 💼 GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship26no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked31no data
💼 NIST CSF v2.0 → 💼 ID.RA-10: Critical suppliers are assessed prior to acquisition26no data
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging22no data
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents31no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated25no data
💼 NIST SP 800-53 Revision 4 → 💼 AU-6 AUDIT REVIEW, ANALYSIS, AND REPORTING1022no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1719no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-3(1) Content of Audit Records _ Additional Audit Information1314no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44765no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81725no data
💼 PCI DSS v3.2.1 → 💼 10.1 Implement audit trails to link all access to system components to each individual user.47no data
💼 PCI DSS v3.2.1 → 💼 10.2.1 All individual user accesses to cardholder data.414no data
💼 PCI DSS v3.2.1 → 💼 10.2.4 Invalid logical access attempts.414no data
💼 PCI DSS v4.0.1 → 💼 10.2.1.1 Audit logs capture all individual user access to cardholder data.14no data
💼 PCI DSS v4.0.1 → 💼 10.2.1.4 Audit logs capture all invalid logical access attempts.14no data
💼 PCI DSS v4.0 → 💼 10.2.1.1 Audit logs capture all individual user access to cardholder data.114no data
💼 PCI DSS v4.0 → 💼 10.2.1.4 Audit logs capture all invalid logical access attempts.114no data
💼 SOC 2 → 💼 CC5.2-3 Establishes Relevant Security Management Process Controls Activities1536no data
💼 SOC 2 → 💼 CC7.1-2 Monitors Infrastructure and Software811no data