Control: Key vaults should have soft delete enabled
Description
Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of a key vault can lead to permanent data loss. Soft delete allows you to recover an accidentally deleted key vault for a configurable retention period.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.keyvault_soft_delete_enabledSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.keyvault_soft_delete_enabled --shareSQL
This control uses a named query:
select kv.id as resource, case when soft_delete_enabled then 'ok' else 'alarm' end as status, case when soft_delete_enabled then name || ' soft delete enabled.' else name || ' soft delete disabled.' end as reason , kv.resource_group as resource_group , sub.display_name as subscriptionfrom azure_key_vault as kv left join azure_subscription as sub on sub.subscription_id = kv.subscription_id;