💼 9.3.5 Ensure the Key Vault is Recoverable (Automated)
- Contextual name: 💼 9.3.5 Ensure the Key Vault is Recoverable (Automated)
- ID:
/frameworks/cis-azure-v4.0.0/09/03/05 - Located in: 💼 9.3 Key Vault
Description
Key Vaults contain object keys, secrets, and certificates. Deletion of a Key Vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the Key Vault objects.
It is recommended the Key Vault be made recoverable by enabling the "Do Not Purge" and "Soft Delete" functions. This is in order to prevent loss of encrypted data, including storage accounts, SQL databases, and/or dependent services provided by Key Vault objects (Keys, Secrets, Certificates) etc. This may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.
NOTE: In February 2025, Microsoft will enable soft-delete protection on all key vaults, and users will no longer be able to opt out of or turn off soft-delete.
WARNING: A current limitation is that role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.
Similar
- Sections
/frameworks/cis-azure-v3.0.0/03/03/05
Similar Sections (Take Policies From)
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|---|---|---|---|
| 💼 CIS Azure v3.0.0 → 💼 3.3.5 Ensure the Key Vault is Recoverable (Automated) | 1 |
Similar Sections (Give Policies To)
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|---|---|---|---|
| 💼 CIS Azure v3.0.0 → 💼 3.3.5 Ensure the Key Vault is Recoverable (Automated) | 1 |
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|
Policies (1)
| Policy | Logic Count | Flags |
|---|---|---|
| 📝 Azure Key Vault Soft Delete and Purge Protection functions are not enabled 🟢 | 1 | 🟢 x6 |