Policy Packs

guardrails-samples

This section covers security recommendations to follow for the configuration and use of Azure Key Vault.

Azure CIS v2.0.0 - Section 8 - Key Vault

main

azure_keyvault_key_expiration

Define the expiration setting required for `Azure &gt; Key Vault &gt; Key`.&#92;n&#92;nEnabling key expiration ensures compliance with security policies by validating that all keys are configured to expire, thereby preventing unauthorized, prolonged use of outdated or potentially compromised keys.&#92;n

keyExpiration

Azure > Key Vault > Key > Expiration

azure_keyvault_secret_expiration

Define the expiration setting required for `Azure &gt; Key Vault &gt; Secret`.&#92;n&#92;nEnabling secret expiration ensures compliance with security policies by validating that all secrets are configured to expire, thereby preventing unauthorized, prolonged use of outdated or potentially compromised secrets.&#92;n

secretExpiration

Azure > Key Vault > Secret > Expiration

azure_keyvault_vault_approved

Determine the action to take when an Azure Key Vault vault is not approved based on `Azure &gt; Key Vault &gt; Vault &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

vaultApproved

Azure > Key Vault > Vault > Approved

azure_keyvault_vault_approved_custom

Determine whether the Azure Key Vault vault is allowed to exist.&#92;nThis policy will be evaluated by the Approved control. If an Azure Key Vault vault is not approved, it will be subject to the action specified in the `Azure &gt; Key Vault &gt; Vault &gt; Approved` policy.&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Approved`, `Not approved` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Approved` or `Not approved`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n

vaultApprovedCustom

Azure > Key Vault > Vault > Approved > Custom

azure_keyvault_vault_purge_protection

Configure Purge Protection for the `Azure &gt; Key Vault &gt; Vault`. Enabling Purge Protection will enforce a mandatory retention period and prevent the permanent deletion of key vaults or secrets prior to the end of the retention period.&#92;n

Policy	Setting	Note
Azure > Key Vault > Key > Expiration	Check: Expiration	Azure CIS v2.0.0 - Control: 8.1 and 8.2
Azure > Key Vault > Secret > Expiration	Check: Expiration	Azure CIS v2.0.0 - Control: 8.3 and 8.4
Azure > Key Vault > Vault > Approved	Check: Approved	Azure CIS v2.0.0 - Control: 8.6 and 8.7
Azure > Key Vault > Vault > Approved > Custom	Calculated	Azure CIS v2.0.0 - Control: 8.6 and 8.7
Azure > Key Vault > Vault > Purge Protection	Check: Purge Protection Enabled	Azure CIS v2.0.0 - Control: 8.5

Policy Settings