Benchmark: Key Vault
Description
This section contains recommendations for configuring Key Vault resources.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select Key Vault.
Run this benchmark in your terminal:
powerpipe benchmark run azure_compliance.benchmark.all_controls_keyvaultSnapshot and share results via Turbot Pipes:
powerpipe benchmark run azure_compliance.benchmark.all_controls_keyvault --shareControls
- Azure Key Vault should have firewall enabled
- Ensure automatic key rotation is enabled within Azure Key Vault
- Key Vault keys should have an expiration date
- Resource logs in Key Vault should be enabled
- Resource logs in Azure Key Vault Managed HSM should be enabled
- Azure Key Vault Managed HSM should have purge protection enabled
- Key vaults should have deletion protection enabled
- Enable Role Based Access Control for Azure Key Vault
- Key Vault secrets should have an expiration date
- Key vaults should have soft delete enabled
- Azure Key Vaults should use private link
- Azure Key Vault should disable public network access
- Ensure the key vault is recoverable
- Key Vault should use a virtual network service endpoint
- Ensure that the Expiration Date is set for all Keys in Non-RBAC Key Vaults
- Ensure that the Expiration Date is set for all Secrets in Non-RBAC Key Vaults
- Ensure that the Expiration Date is set for all Keys in RBAC Key Vaults
- Ensure that the Expiration Date is set for all Secrets in RBAC Key Vaults
- Ensure certificate 'Validity Period (in months)' is less than or equal to '12'