🛡️ Azure Subscription Activity Log Alert for Update Key Vault Access Policy does not exist🟢

• Contextual name: 🛡️ Subscription Activity Log Alert for Update Key Vault Access Policy does not exist🟢
• ID: /ce/ca/azure/subscription/activity-log-alert-for-update-key-vault-access-policy
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Subscription
  • 🔌 Azure Activity Log Alert - object.extracts.yaml
  • 🔌 Azure Subscription - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Create an activity log alert rule that notifies an action group whenever the activity log records the key vault Update Access Policy operation in the Administrative category. The alert fires only for vaults that use the vault access policy permission model.

Rationale

On a vault that uses the access policy permission model, an access policy grants data plane permissions to keys, secrets and certificates, and any principal with key vault write permission, such as Contributor, can grant itself that access. An added or widened policy therefore exposes the vault's secrets while appearing as a routine vault change.

Audit

This policy marks an Azure Subscription as INCOMPLIANT if no current enabled Activity Log Alert covers Administrative / Microsoft.KeyVault/vaults/accessPolicies/write, has a resolved action group, and covers the subscription root. Category and operation must occur on their matching JSON fields, with no additional Level, Status, Caller, or other filter.

A qualifying alert makes the subscription COMPLIANT. Otherwise, unassessable alert configuration produces UNDETERMINED. Complex or narrower scope strings require manual review and do not prove subscription-wide coverage. Notification recipients and delivery must be verified operationally.

Remediation

Open File

Remediation

Create an enabled Activity Log Alert for Microsoft.KeyVault/vaults/accessPolicies/write in the Administrative category across the affected subscription. Set the scope to /subscriptions/{{subscription-id}}.

This operation applies to key vaults that use the vault access policy permission model.

Review existing alerts for this event before creating another. Select a current action group with enabled notification receivers for the responsible team, and review the expected notification volume and any charges for its notification channels.

Use an unused alert-rule name for the command examples. Before editing an existing rule, record its configuration and retain all action groups that are still required.

From Azure Portal

1. Go to Monitor > Alerts and select Create > Alert rule.
2. On the Scope tab, select the affected subscription itself and select Apply.
3. On the Condition tab, select See all signals, choose Update Access Policy (Access Policies), and select Apply.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 6.1.2.17 Ensure that Activity Log Alert Exists for Update Key Vault Access Policy (Automated)			1		no data
💼 Cloudaware Framework → 💼 Alerting and Notification			49		no data