9.11 Ensure Azure Key Vaults are Used to Store Secrets

Information

Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.

Rationale:

The credentials given to an application have permissions to create, delete, or modify data stored within the systems they access. If these credentials are stored within the application itself, anyone with access to the application or a copy of the code has access to them. Storing within Azure Key Vault as secrets increases security by controlling access. This also allows for updates of the credentials without redeploying the entire application.

Impact:

Integrating references to secrets within the key vault are required to be specifically integrated within the application code. This will require additional configuration to be made during the writing of an application, or refactoring of an already written one. There are also additional costs that are charged per 10000 requests to the Key Vault.

Solution

Remediation has 2 steps

Setup the Key Vault

Setup the App Service to use the Key Vault

Step 1: Set up the Key Vault
Remediate from Azure CLI

az keyvault create --name '<name>' --resource-group '<myResourceGroup>' --location myLocation

Remediate from PowerShell

New-AzKeyvault -name <name> -ResourceGroupName <myResourceGroup> -Location <myLocation>

Step 2: Set up the App Service to use the Key Vault
Sample JSON Template for App Service Configuration (starting next page):

{
//...
'resources': [
{
'type': 'Microsoft.Storage/storageAccounts',
'name': '[variables('storageAccountName')]',
//...
},
{
'type': 'Microsoft.Insights/components',
'name': '[variables('appInsightsName')]',
//...
},
{
'type': 'Microsoft.Web/sites',
'name': '[variables('functionAppName')]',
'identity': {
'type': 'SystemAssigned'
},
//...
'resources': [
{
'type': 'config',
'name': 'appsettings',
//...
'dependsOn': [
'[resourceId('Microsoft.Web/sites', variables('functionAppName'))]',
'[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]',
'[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('storageConnectionStringName'))]',
'[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('appInsightsKeyName'))]'
],
'properties': {
'AzureWebJobsStorage': '[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]',
'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING': '[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]',
'APPINSIGHTS_INSTRUMENTATIONKEY': '[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('appInsightsKeyResourceId')).secretUriWithVersion, ')')]',
'WEBSITE_ENABLE_SYNC_UPDATE_SITE': 'true'
//...
}
},
{
'type': 'sourcecontrols',
'name': 'web',
//...
'dependsOn': [
'[resourceId('Microsoft.Web/sites', variables('functionAppName'))]',
'[resourceId('Microsoft.Web/sites/config', variables('functionAppName'), 'appsettings')]'
],
}
]
},
{
'type': 'Microsoft.KeyVault/vaults',
'name': '[variables('keyVaultName')]',
//...
'dependsOn': [
'[resourceId('Microsoft.Web/sites', variables('functionAppName'))]'
],
'properties': {
//...
'accessPolicies': [
{
'tenantId': '[reference(concat('Microsoft.Web/sites/', variables('functionAppName'), '/providers/Microsoft.ManagedIdentity/Identities/default'), '2015-08-31-PREVIEW').tenantId]',
'objectId': '[reference(concat('Microsoft.Web/sites/', variables('functionAppName'), '/providers/Microsoft.ManagedIdentity/Identities/default'), '2015-08-31-PREVIEW').principalId]',
'permissions': {
'secrets': [ 'get' ]
}
}
]
},
'resources': [
{
'type': 'secrets',
'name': '[variables('storageConnectionStringName')]',
//...
'dependsOn': [
'[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]',
'[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]'
],
'properties': {
'value': '[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';AccountKey=', listKeys(variables('storageAccountResourceId'),'2015-05-01-preview').key1)]'
}
},
{
'type': 'secrets',
'name': '[variables('appInsightsKeyName')]',
//...
'dependsOn': [
'[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]',
'[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]'
],
'properties': {
'value': '[reference(resourceId('microsoft.insights/components/', variables('appInsightsName')), '2015-05-01').InstrumentationKey]'
}
}
]
}
]
}

Default Value:

By default, no Azure Key Vaults are created.

Item Details

Audit Name: CIS Microsoft Azure Foundations v3.0.0 L2

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-11, 800-53|SI-12, CSCv7|13.1

Plugin: microsoft_azure

Control ID: 90b1335597bedfef39bf9fbc936fe37b54e3c7bb30d53c6caf98962c814e5309

Detections

Analytics

9.11 Ensure Azure Key Vaults are Used to Store Secrets

Information

Solution

See Also

Item Details