Control: Key vaults should have deletion protection enabled
Description
Malicious deletion of a key vault can lead to permanent data loss. A malicious insider in your organization can potentially delete and purge key vaults. Purge protection protects you from insider attacks by enforcing a mandatory retention period for soft deleted key vaults. No one inside your organization or Microsoft will be able to purge your key vaults during the soft delete retention period.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.keyvault_purge_protection_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.keyvault_purge_protection_enabled --shareSQL
This control uses a named query:
select kv.id as resource, case when purge_protection_enabled then 'ok' else 'alarm' end as status, case when purge_protection_enabled then name || ' purge protection enabled.' else name || ' purge protection disabled.' end as reason , kv.resource_group as resource_group , sub.display_name as subscriptionfrom azure_key_vault as kv, azure_subscription as subwhere sub.subscription_id = kv.subscription_id;