Benchmark: Key Vault
Description
This benchmark provides a set of controls that detect Terraform Azure Key Vault resources deviating from security best practices.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-terraform-azure-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select Key Vault.
Run this benchmark in your terminal:
powerpipe benchmark run terraform_azure_compliance.benchmark.keyvaultSnapshot and share results via Turbot Pipes:
powerpipe benchmark run terraform_azure_compliance.benchmark.keyvault --shareControls
- Azure Defender for Key Vault should be enabled
- Key Vault keys should have an expiration date
- Resource logs in Key Vault should be enabled
- Resource logs in Azure Key Vault Managed HSM should be enabled
- Azure Key Vault Managed HSM should have purge protection enabled
- Key vaults should have purge protection enabled
- Key Vault secrets should have a content type
- Key Vault secrets should have an expiration date
- Azure Key Vault should disable public network access
- Key Vault should use a virtual network service endpoint