Policy: Azure > CIS v2.0 > 08 - Key Vault > 8.05 - Ensure the key vault is recoverable
Configures auditing against a CIS Benchmark item.
Level: 1
The key vault contains object keys, secrets and certificates. Accidental unavailability of a key vault can cause immediate data loss or loss of security functions (authentication, validation, verification, non-repudiation, etc.) supported by the key vault objects.
It is recommended the key vault be made recoverable by enabling the "Do Not Purge" and "Soft Delete" functions. This is in order to prevent loss of encrypted data including storage accounts, SQL databases, and/or dependent services provided by key vault objects (Keys, Secrets, Certificates) etc., as may happen in the case of accidental deletion by a user or from disruptive activity by a malicious user.
WARNING: A current limitation of the soft-delete feature across all Azure services is role assignments disappearing when Key Vault is deleted. All role assignments will need to be recreated after recovery.
Resource Types
This policy targets the following resource types:
Primary Policy
This policy is used with the following primary policy:
Controls
- Azure > CIS v2.0
- Azure > CIS v2.0 > 08 - Key Vault > 8.05 - Ensure the key vault is recoverable
- Azure > CIS v2.0 > 08 - Key Vault
Policy Specification
Schema Type |
|
---|---|
Default |
|
Valid Values [YAML] |
|
Category
In Your Workspace
Developers
- tmod:@turbot/cis#/control/categories/v071002
- tmod:@turbot/azure-cisv2-0#/policy/types/r0805
- turbot graphql policy-type --id "tmod:@turbot/azure-cisv2-0#/policy/types/r0805"
- turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/azure-cisv2-0#/policy/types/r0805"
Get Policy TypeGet Policy Settings