Skip to content

Commit dc728ad

Browse files
BernieWhiteBernieWhite
authored
Updates to Key Vault rules docs (Azure#2667)
1 parent d3f4078 commit dc728ad

5 files changed

+112
-59
lines changed

‎docs/en/rules/Azure.KeyVault.PurgeProtect.md

+42-19
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
reviewed: 2023-02-18
2+
reviewed: 2024-02-02
33
severity: Important
44
pillar: Reliability
5-
category: Data management
5+
category: RE:07 Self-preservation
66
resource: Key Vault
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.PurgeProtect/
88
---
@@ -41,20 +41,25 @@ For example:
4141

4242
```json
4343
{
44-
"type": "Microsoft.KeyVault/vaults",
45-
"apiVersion": "2021-10-01",
46-
"name": "[parameters('name')]",
47-
"location": "[parameters('location')]",
48-
"properties": {
49-
"sku": {
50-
"family": "A",
51-
"name": "premium"
52-
},
53-
"tenantId": "[subscription().tenantId]",
54-
"enableSoftDelete": true,
55-
"softDeleteRetentionInDays": 90,
56-
"enablePurgeProtection": true
44+
"type": "Microsoft.KeyVault/vaults",
45+
"apiVersion": "2023-07-01",
46+
"name": "[parameters('name')]",
47+
"location": "[parameters('location')]",
48+
"properties": {
49+
"sku": {
50+
"family": "A",
51+
"name": "premium"
52+
},
53+
"tenantId": "[tenant().tenantId]",
54+
"softDeleteRetentionInDays": 90,
55+
"enableSoftDelete": true,
56+
"enablePurgeProtection": true,
57+
"enableRbacAuthorization": true,
58+
"networkAcls": {
59+
"defaultAction": "Deny",
60+
"bypass": "AzureServices"
5761
}
62+
}
5863
}
5964
```
6065

@@ -67,18 +72,23 @@ To deploy Key Vaults that pass this rule:
6772
For example:
6873

6974
```bicep
70-
resource vault 'Microsoft.KeyVault/vaults@2021-10-01' = {
75+
resource vault 'Microsoft.KeyVault/vaults@2023-07-01' = {
7176
name: name
7277
location: location
7378
properties: {
7479
sku: {
7580
family: 'A'
7681
name: 'premium'
7782
}
78-
tenantId: subscription().tenantId
79-
enableSoftDelete: true
83+
tenantId: tenant().tenantId
8084
softDeleteRetentionInDays: 90
85+
enableSoftDelete: true
8186
enablePurgeProtection: true
87+
enableRbacAuthorization: true
88+
networkAcls: {
89+
defaultAction: 'Deny'
90+
bypass: 'AzureServices'
91+
}
8292
}
8393
}
8494
```
@@ -89,8 +99,21 @@ resource vault 'Microsoft.KeyVault/vaults@2021-10-01' = {
8999
az keyvault update -n '<name>' -g '<resource_group>' --enable-purge-protection
90100
```
91101

102+
### Configure with Azure PowerShell
103+
104+
```powershell
105+
Update-AzKeyVault -ResourceGroupName '<resource_group>' -Name '<name>' -EnablePurgeProtection
106+
```
107+
108+
### Configure with Azure Policy
109+
110+
To address this issue at runtime use the following policies:
111+
112+
- [Key vaults should have deletion protection enabled](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_Recoverable_Audit.json)
113+
92114
## LINKS
93115

116+
- [RE:07 Self-preservation](https://learn.microsoft.com/azure/well-architected/reliability/self-preservation)
94117
- [Azure Key Vault soft-delete overview](https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview)
95-
- [Azure Key Vault security](https://learn.microsoft.com/azure/key-vault/general/security-features#backup-and-recovery)
118+
- [Azure Key Vault security](https://learn.microsoft.com/azure/key-vault/general/security-features)
96119
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.keyvault/vaults)

‎docs/en/rules/Azure.KeyVault.RBAC.md

+13-6
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
reviewed: 2023-08-20
2+
reviewed: 2024-02-02
33
severity: Awareness
44
pillar: Security
5-
category: Authorization
5+
category: SE:05 Identity and access management
66
resource: Key Vault
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.RBAC/
88
---
@@ -41,7 +41,7 @@ For example:
4141
```json
4242
{
4343
"type": "Microsoft.KeyVault/vaults",
44-
"apiVersion": "2023-02-01",
44+
"apiVersion": "2023-07-01",
4545
"name": "[parameters('name')]",
4646
"location": "[parameters('location')]",
4747
"properties": {
@@ -71,7 +71,7 @@ To deploy Key Vaults that pass this rule:
7171
For example:
7272

7373
```bicep
74-
resource vault 'Microsoft.KeyVault/vaults@2023-02-01' = {
74+
resource vault 'Microsoft.KeyVault/vaults@2023-07-01' = {
7575
name: name
7676
location: location
7777
properties: {
@@ -104,6 +104,12 @@ az keyvault update -n '<name>' -g '<resource_group>' --enable-rbac-authorization
104104
Update-AzKeyVault -ResourceGroupName '<resource_group>' -Name '<name>' -EnableRbacAuthorization
105105
```
106106

107+
### Configure with Azure Policy
108+
109+
To address this issue at runtime use the following policies:
110+
111+
- [Azure Key Vault should use RBAC permission model](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/AzureKeyVault_Should_Use_RBAC.json)
112+
107113
## NOTES
108114

109115
The RBAC permission model may not be suitable for all use cases.
@@ -112,11 +118,12 @@ For information about limitations see _Azure role-based access control vs. acces
112118

113119
## LINKS
114120

115-
- [Role-based authorization](https://learn.microsoft.com/azure/well-architected/security/design-identity-authorization#role-based-authorization)
121+
- [SE:05 Identity and access management](https://learn.microsoft.com/azure/well-architected/security/identity-access)
116122
- [What is Azure role-based access control?](https://learn.microsoft.com/azure/role-based-access-control/overview)
117123
- [Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control](https://learn.microsoft.com/azure/key-vault/general/rbac-guide)
118124
- [Azure role-based access control vs. access policies](https://learn.microsoft.com/azure/key-vault/general/rbac-access-policy)
119125
- [Migrate from vault access policy to an Azure role-based access control permission model](https://learn.microsoft.com/azure/key-vault/general/rbac-migration)
126+
- [Azure Key Vault security](https://learn.microsoft.com/azure/key-vault/general/security-features)
120127
- [Azure security baseline for Key Vault](https://learn.microsoft.com/security/benchmark/azure/baselines/key-vault-security-baseline)
121128
- [IM-1: Use centralized identity and authentication system](https://learn.microsoft.com/security/benchmark/azure/baselines/key-vault-security-baseline#im-1-use-centralized-identity-and-authentication-system)
122-
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.keyvault/vaults#vaultproperties)
129+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.keyvault/vaults)

‎docs/en/rules/Azure.KeyVault.SoftDelete.md

+45-20
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
2+
reviewed: 2024-02-02
23
severity: Important
34
pillar: Reliability
4-
category: Data management
5+
category: RE:07 Self-preservation
56
resource: Key Vault
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SoftDelete/
78
---
@@ -38,20 +39,25 @@ For example:
3839

3940
```json
4041
{
41-
"type": "Microsoft.KeyVault/vaults",
42-
"apiVersion": "2021-10-01",
43-
"name": "[parameters('name')]",
44-
"location": "[parameters('location')]",
45-
"properties": {
46-
"sku": {
47-
"family": "A",
48-
"name": "premium"
49-
},
50-
"tenantId": "[subscription().tenantId]",
51-
"enableSoftDelete": true,
52-
"softDeleteRetentionInDays": 90,
53-
"enablePurgeProtection": true
42+
"type": "Microsoft.KeyVault/vaults",
43+
"apiVersion": "2023-07-01",
44+
"name": "[parameters('name')]",
45+
"location": "[parameters('location')]",
46+
"properties": {
47+
"sku": {
48+
"family": "A",
49+
"name": "premium"
50+
},
51+
"tenantId": "[tenant().tenantId]",
52+
"softDeleteRetentionInDays": 90,
53+
"enableSoftDelete": true,
54+
"enablePurgeProtection": true,
55+
"enableRbacAuthorization": true,
56+
"networkAcls": {
57+
"defaultAction": "Deny",
58+
"bypass": "AzureServices"
5459
}
60+
}
5561
}
5662
```
5763

@@ -64,24 +70,43 @@ To deploy Key Vaults that pass this rule:
6470
For example:
6571

6672
```bicep
67-
resource vault 'Microsoft.KeyVault/vaults@2021-10-01' = {
73+
resource vault 'Microsoft.KeyVault/vaults@2023-07-01' = {
6874
name: name
6975
location: location
7076
properties: {
7177
sku: {
7278
family: 'A'
7379
name: 'premium'
7480
}
75-
tenantId: subscription().tenantId
76-
enableSoftDelete: true
81+
tenantId: tenant().tenantId
7782
softDeleteRetentionInDays: 90
83+
enableSoftDelete: true
7884
enablePurgeProtection: true
85+
enableRbacAuthorization: true
86+
networkAcls: {
87+
defaultAction: 'Deny'
88+
bypass: 'AzureServices'
89+
}
7990
}
8091
}
8192
```
8293

94+
### Configure with Azure CLI
95+
96+
```bash
97+
az keyvault update -n '<name>' -g '<resource_group>' --retention-days 90
98+
```
99+
100+
### Configure with Azure Policy
101+
102+
To address this issue at runtime use the following policies:
103+
104+
- [Key vaults should have soft delete enabled](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Key%20Vault/KeyVault_SoftDeleteMustBeEnabled_Audit.json)
105+
83106
## LINKS
84107

85-
- [Azure Key Vault soft-delete overview](https://docs.microsoft.com/azure/key-vault/general/soft-delete-overview)
86-
- [Azure Key Vault security](https://docs.microsoft.com/azure/key-vault/general/security-overview#backup-and-recovery)
87-
- [Azure deployment reference](https://docs.microsoft.com/azure/templates/microsoft.keyvault/vaults)
108+
- [RE:07 Self-preservation](https://learn.microsoft.com/azure/well-architected/reliability/self-preservation)
109+
- [Azure Key Vault soft-delete overview](https://learn.microsoft.com/azure/key-vault/general/soft-delete-overview)
110+
- [Soft-delete will be enabled on all key vaults](https://learn.microsoft.com/azure/key-vault/general/soft-delete-change)
111+
- [Azure Key Vault security](https://learn.microsoft.com/azure/key-vault/general/security-features)
112+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.keyvault/vaults)

‎docs/examples-keyvault.bicep

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ param objectId string
1616
param workspaceId string
1717

1818
// An example Key Vault with access policies.
19-
resource vaultWithAccessPolicies 'Microsoft.KeyVault/vaults@2023-02-01' = {
19+
resource vaultWithAccessPolicies 'Microsoft.KeyVault/vaults@2023-07-01' = {
2020
name: name
2121
location: location
2222
properties: {
@@ -45,7 +45,7 @@ resource vaultWithAccessPolicies 'Microsoft.KeyVault/vaults@2023-02-01' = {
4545
}
4646

4747
// An example Key Vault with RBAC authorization.
48-
resource vault 'Microsoft.KeyVault/vaults@2023-02-01' = {
48+
resource vault 'Microsoft.KeyVault/vaults@2023-07-01' = {
4949
name: name
5050
location: location
5151
properties: {

‎docs/examples-keyvault.json

+10-12
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,11 @@
11
{
22
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3-
"languageVersion": "1.10-experimental",
43
"contentVersion": "1.0.0.0",
54
"metadata": {
6-
"_EXPERIMENTAL_WARNING": "Symbolic name support in ARM is experimental, and should be enabled for testing purposes only. Do not enable this setting for any production usage, or you may be unexpectedly broken at any time!",
75
"_generator": {
86
"name": "bicep",
9-
"version": "0.20.4.51522",
10-
"templateHash": "1553055841733853074"
7+
"version": "0.24.24.22086",
8+
"templateHash": "3218451149490833125"
119
}
1210
},
1311
"parameters": {
@@ -37,10 +35,10 @@
3735
}
3836
}
3937
},
40-
"resources": {
41-
"vaultWithAccessPolicies": {
38+
"resources": [
39+
{
4240
"type": "Microsoft.KeyVault/vaults",
43-
"apiVersion": "2023-02-01",
41+
"apiVersion": "2023-07-01",
4442
"name": "[parameters('name')]",
4543
"location": "[parameters('location')]",
4644
"properties": {
@@ -67,9 +65,9 @@
6765
]
6866
}
6967
},
70-
"vault": {
68+
{
7169
"type": "Microsoft.KeyVault/vaults",
72-
"apiVersion": "2023-02-01",
70+
"apiVersion": "2023-07-01",
7371
"name": "[parameters('name')]",
7472
"location": "[parameters('location')]",
7573
"properties": {
@@ -88,7 +86,7 @@
8886
}
8987
}
9088
},
91-
"logs": {
89+
{
9290
"type": "Microsoft.Insights/diagnosticSettings",
9391
"apiVersion": "2021-05-01-preview",
9492
"scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
@@ -103,8 +101,8 @@
103101
]
104102
},
105103
"dependsOn": [
106-
"vault"
104+
"[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
107105
]
108106
}
109-
}
107+
]
110108
}

0 commit comments

Comments
 (0)