Key Vault Not Recoverable
- Query id: 7c25f361-7c66-44bf-9b69-022acd5eb4bd
- Query name: Key Vault Not Recoverable
- Platform: AzureResourceManager
- Severity: High
- Category: Backup
- CWE: 530
- URL: Github
Description¶
Key Vault should have 'enableSoftDelete' and 'enablePurgeProtection' set to true
Documentation
Code samples¶
Code samples with security vulnerabilities¶
Positive test num. 1 - bicep file
resource keyVaultInstance 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'keyVaultInstance'
location: 'location'
tags: {}
properties: {
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
sku: {
family: 'A'
name: 'standard'
}
accessPolicies: [
{
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
objectId: '99998888-8666-4144-9199-2d7cd0111111'
permissions: {
keys: ['encrypt']
}
}
]
vaultUri: 'string'
enabledForDeployment: true
enabledForDiskEncryption: true
enabledForTemplateDeployment: true
enableSoftDelete: true
softDeleteRetentionInDays: 80
enableRbacAuthorization: true
}
}
Positive test num. 2 - json file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "2.0.0.0",
"apiProfile": "2019-03-01-hybrid",
"parameters": {},
"variables": {},
"functions": [],
"resources": [
{
"name": "keyVaultInstance",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"location": "location",
"tags": {},
"properties": {
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [
{
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"objectId": "99998888-8666-4144-9199-2d7cd0111111",
"permissions": {
"keys": [
"encrypt"
]
}
}
],
"vaultUri": "string",
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 80,
"enableRbacAuthorization": true
},
"resources": []
}
],
"outputs": {}
}
Positive test num. 3 - bicep file
resource keyVaultInstance 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'keyVaultInstance'
location: 'location'
tags: {}
properties: {
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
sku: {
family: 'A'
name: 'standard'
}
accessPolicies: [
{
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
objectId: '99998888-8666-4144-9199-2d7cd0111111'
permissions: {
keys: ['encrypt']
}
}
]
vaultUri: 'string'
enabledForDeployment: true
enabledForDiskEncryption: true
enabledForTemplateDeployment: true
enableSoftDelete: true
softDeleteRetentionInDays: 80
enableRbacAuthorization: true
enablePurgeProtection: false
}
}
Positive test num. 4 - json file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "2.0.0.0",
"apiProfile": "2019-03-01-hybrid",
"parameters": {},
"variables": {},
"functions": [],
"resources": [
{
"name": "keyVaultInstance",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"location": "location",
"tags": {},
"properties": {
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [
{
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"objectId": "99998888-8666-4144-9199-2d7cd0111111",
"permissions": {
"keys": [
"encrypt"
]
}
}
],
"vaultUri": "string",
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 80,
"enableRbacAuthorization": true,
"enablePurgeProtection": false
},
"resources": []
}
],
"outputs": {}
}
Positive test num. 5 - bicep file
resource keyVaultInstance 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'keyVaultInstance'
location: 'location'
tags: {}
properties: {
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
sku: {
family: 'A'
name: 'standard'
}
accessPolicies: [
{
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
objectId: '99998888-8666-4144-9199-2d7cd0111111'
permissions: {
keys: ['encrypt']
}
}
]
vaultUri: 'string'
enabledForDeployment: true
enabledForDiskEncryption: true
enabledForTemplateDeployment: true
enableSoftDelete: true
softDeleteRetentionInDays: 80
enableRbacAuthorization: true
}
}
Positive test num. 6 - json file
{
"properties": {
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "2.0.0.0",
"apiProfile": "2019-03-01-hybrid",
"parameters": {},
"variables": {},
"functions": [],
"resources": [
{
"name": "keyVaultInstance",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"location": "location",
"tags": {},
"properties": {
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [
{
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"objectId": "99998888-8666-4144-9199-2d7cd0111111",
"permissions": {
"keys": [
"encrypt"
]
}
}
],
"vaultUri": "string",
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 80,
"enableRbacAuthorization": true
},
"resources": []
}
],
"outputs": {}
},
"resourceGroup": "storageRG",
"parameters": {
"storageAccountType": {
"value": "[parameters('storageAccountType')]"
}
}
},
"kind": "template",
"id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
"type": "Microsoft.Blueprint/blueprints/artifacts",
"name": "storageTemplate"
}
Positive test num. 7 - bicep file
resource keyVaultInstance 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'keyVaultInstance'
location: 'location'
tags: {}
properties: {
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
sku: {
family: 'A'
name: 'standard'
}
accessPolicies: [
{
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
objectId: '99998888-8666-4144-9199-2d7cd0111111'
permissions: {
keys: ['encrypt']
}
}
]
vaultUri: 'string'
enabledForDeployment: true
enabledForDiskEncryption: true
enabledForTemplateDeployment: true
enableSoftDelete: true
softDeleteRetentionInDays: 80
enableRbacAuthorization: true
enablePurgeProtection: false
}
}
Positive test num. 8 - json file
{
"properties": {
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "2.0.0.0",
"apiProfile": "2019-03-01-hybrid",
"parameters": {},
"variables": {},
"functions": [],
"resources": [
{
"name": "keyVaultInstance",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"location": "location",
"tags": {},
"properties": {
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [
{
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"objectId": "99998888-8666-4144-9199-2d7cd0111111",
"permissions": {
"keys": [
"encrypt"
]
}
}
],
"vaultUri": "string",
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 80,
"enableRbacAuthorization": true,
"enablePurgeProtection": false
},
"resources": []
}
],
"outputs": {}
},
"resourceGroup": "storageRG",
"parameters": {
"storageAccountType": {
"value": "[parameters('storageAccountType')]"
}
}
},
"kind": "template",
"id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
"type": "Microsoft.Blueprint/blueprints/artifacts",
"name": "storageTemplate"
}
Positive test num. 9 - bicep file
param vaults_pgs_bot_prod_name int = 5
resource vaults_pgs_bot_prod_name_resource 'Microsoft.KeyVault/vaults@2016-10-01' = {
name: vaults_pgs_bot_prod_name
location: 'westeurope'
tags: {
ProjectCodeBU: 'UKMUMD'
ApplicationName: 'PGS HR Chatbot'
ProjectCodePGDS: 'PRJ0024896'
CostCentreBU: 'UKMUMD'
DataClassification: 'General'
BusinessUnit: 'PGS'
Owner: 'Pru UK Andover Innovation Team'
Contact: 'andover2@prudential.co.uk'
CostCentrePGDS: 'ITBUEXP'
Criticality: 'Low'
}
properties: {
sku: {
family: 'A'
name: 'standard'
}
tenantId: 'aa42167d-6f8d-45ce-b655-d245ef97da66'
accessPolicies: [
{
tenantId: 'aa42167d-6f8d-45ce-b655-d245ef97da66'
objectId: 'f3e7baf5-8d66-4fb2-b7aa-7b7484309df6'
permissions: {
keys: [
'Get'
'Create'
'Delete'
'List'
'Update'
'Import'
'Backup'
'Restore'
'Recover'
]
secrets: [
'Get'
'List'
'Set'
'Delete'
'Backup'
'Restore'
'Recover'
]
certificates: [
'Get'
'Delete'
'List'
'Create'
'Import'
'Update'
'DeleteIssuers'
'GetIssuers'
'ListIssuers'
'ManageContacts'
'ManageIssuers'
'SetIssuers'
]
storage: [
'delete'
'deletesas'
'get'
'getsas'
'list'
'listsas'
'regeneratekey'
'set'
'setsas'
'update'
]
}
}
{
tenantId: 'aa42167d-6f8d-45ce-b655-d245ef97da66'
objectId: '1033a977-ffdc-4359-869a-b673d075f128'
permissions: {
keys: []
secrets: [
'Get'
]
certificates: []
storage: []
}
}
{
tenantId: 'aa42167d-6f8d-45ce-b655-d245ef97da66'
objectId: '13be5d2d-6e1f-4667-add4-02d2d1142ac5'
permissions: {
keys: []
secrets: [
'Get'
'List'
'Set'
'Delete'
'Backup'
'Restore'
'Recover'
'Purge'
]
certificates: []
storage: []
}
}
{
tenantId: 'aa42167d-6f8d-45ce-b655-d245ef97da66'
objectId: 'e56a2de8-a788-415f-b10f-14bfd3000e1d'
permissions: {
keys: [
'Get'
'List'
'Update'
'Create'
'Import'
'Delete'
'Recover'
'Backup'
'Restore'
'Decrypt'
'Encrypt'
'UnwrapKey'
'WrapKey'
'Verify'
'Sign'
'Purge'
]
secrets: [
'Get'
'List'
'Set'
'Delete'
'Recover'
'Backup'
'Restore'
'Purge'
]
certificates: [
'Get'
'List'
'Update'
'Create'
'Import'
'Delete'
'Recover'
'Backup'
'Restore'
'ManageContacts'
'ManageIssuers'
'GetIssuers'
'ListIssuers'
'SetIssuers'
'DeleteIssuers'
'Purge'
]
}
}
]
enabledForDeployment: false
enabledForDiskEncryption: false
enabledForTemplateDeployment: false
}
}
Positive test num. 10 - json file
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"variables": {},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2016-10-01",
"name": "[parameters('vaults_pgs_bot_prod_name')]",
"location": "westeurope",
"tags": {
"ProjectCodeBU": "UKMUMD",
"ApplicationName": "PGS HR Chatbot",
"ProjectCodePGDS": "PRJ0024896",
"CostCentreBU": "UKMUMD",
"DataClassification": "General",
"BusinessUnit": "PGS",
"Owner": "Pru UK Andover Innovation Team",
"Contact": "andover2@prudential.co.uk",
"CostCentrePGDS": "ITBUEXP",
"Criticality": "Low"
},
"properties": {
"sku": {
"family": "A",
"name": "standard"
},
"tenantId": "aa42167d-6f8d-45ce-b655-d245ef97da66",
"accessPolicies": [
{
"tenantId": "aa42167d-6f8d-45ce-b655-d245ef97da66",
"objectId": "f3e7baf5-8d66-4fb2-b7aa-7b7484309df6",
"permissions": {
"keys": [
"Get",
"Create",
"Delete",
"List",
"Update",
"Import",
"Backup",
"Restore",
"Recover"
],
"secrets": [
"Get",
"List",
"Set",
"Delete",
"Backup",
"Restore",
"Recover"
],
"certificates": [
"Get",
"Delete",
"List",
"Create",
"Import",
"Update",
"DeleteIssuers",
"GetIssuers",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"SetIssuers"
],
"storage": [
"delete",
"deletesas",
"get",
"getsas",
"list",
"listsas",
"regeneratekey",
"set",
"setsas",
"update"
]
}
},
{
"tenantId": "aa42167d-6f8d-45ce-b655-d245ef97da66",
"objectId": "1033a977-ffdc-4359-869a-b673d075f128",
"permissions": {
"keys": [],
"secrets": [
"Get"
],
"certificates": [],
"storage": []
}
},
{
"tenantId": "aa42167d-6f8d-45ce-b655-d245ef97da66",
"objectId": "13be5d2d-6e1f-4667-add4-02d2d1142ac5",
"permissions": {
"keys": [],
"secrets": [
"Get",
"List",
"Set",
"Delete",
"Backup",
"Restore",
"Recover",
"Purge"
],
"certificates": [],
"storage": []
}
},
{
"tenantId": "aa42167d-6f8d-45ce-b655-d245ef97da66",
"objectId": "e56a2de8-a788-415f-b10f-14bfd3000e1d",
"permissions": {
"keys": [
"Get",
"List",
"Update",
"Create",
"Import",
"Delete",
"Recover",
"Backup",
"Restore",
"Decrypt",
"Encrypt",
"UnwrapKey",
"WrapKey",
"Verify",
"Sign",
"Purge"
],
"secrets": [
"Get",
"List",
"Set",
"Delete",
"Recover",
"Backup",
"Restore",
"Purge"
],
"certificates": [
"Get",
"List",
"Update",
"Create",
"Import",
"Delete",
"Recover",
"Backup",
"Restore",
"ManageContacts",
"ManageIssuers",
"GetIssuers",
"ListIssuers",
"SetIssuers",
"DeleteIssuers",
"Purge"
]
}
}
],
"enabledForDeployment": false,
"enabledForDiskEncryption": false,
"enabledForTemplateDeployment": false
}
}
]
}
Code samples without security vulnerabilities¶
Negative test num. 1 - bicep file
resource keyVaultInstance 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'keyVaultInstance'
location: 'location'
tags: {}
properties: {
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
sku: {
family: 'A'
name: 'standard'
}
accessPolicies: [
{
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
objectId: '99998888-8666-4144-9199-2d7cd0111111'
permissions: {
keys: ['encrypt']
}
}
]
vaultUri: 'string'
enabledForDeployment: true
enabledForDiskEncryption: true
enabledForTemplateDeployment: true
enableSoftDelete: true
softDeleteRetentionInDays: 80
enableRbacAuthorization: true
enablePurgeProtection: true
}
}
Negative test num. 2 - json file
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "2.0.0.0",
"apiProfile": "2019-03-01-hybrid",
"parameters": {},
"variables": {},
"functions": [],
"resources": [
{
"name": "keyVaultInstance",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"location": "location",
"tags": {},
"properties": {
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [
{
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"objectId": "99998888-8666-4144-9199-2d7cd0111111",
"permissions": {
"keys": [
"encrypt"
]
}
}
],
"vaultUri": "string",
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 80,
"enableRbacAuthorization": true,
"enablePurgeProtection": true
},
"resources": []
}
],
"outputs": {}
}
Negative test num. 3 - bicep file
resource keyVaultInstance 'Microsoft.KeyVault/vaults@2019-09-01' = {
name: 'keyVaultInstance'
location: 'location'
tags: {}
properties: {
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
sku: {
family: 'A'
name: 'standard'
}
accessPolicies: [
{
tenantId: '72f98888-8666-4144-9199-2d7cd0111111'
objectId: '99998888-8666-4144-9199-2d7cd0111111'
permissions: {
keys: ['encrypt']
}
}
]
vaultUri: 'string'
enabledForDeployment: true
enabledForDiskEncryption: true
enabledForTemplateDeployment: true
enableSoftDelete: true
softDeleteRetentionInDays: 80
enableRbacAuthorization: true
enablePurgeProtection: true
}
}
Negative test num. 4 - json file
{
"properties": {
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "2.0.0.0",
"apiProfile": "2019-03-01-hybrid",
"parameters": {},
"variables": {},
"functions": [],
"resources": [
{
"name": "keyVaultInstance",
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2019-09-01",
"location": "location",
"tags": {},
"properties": {
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [
{
"tenantId": "72f98888-8666-4144-9199-2d7cd0111111",
"objectId": "99998888-8666-4144-9199-2d7cd0111111",
"permissions": {
"keys": [
"encrypt"
]
}
}
],
"vaultUri": "string",
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 80,
"enableRbacAuthorization": true,
"enablePurgeProtection": true
},
"resources": []
}
],
"outputs": {}
},
"resourceGroup": "storageRG",
"parameters": {
"storageAccountType": {
"value": "[parameters('storageAccountType')]"
}
}
},
"kind": "template",
"id": "/providers/Microsoft.Management/managementGroups/ContosoOnlineGroup/providers/Microsoft.Blueprint/blueprints/simpleBlueprint/artifacts/storageTemplate",
"type": "Microsoft.Blueprint/blueprints/artifacts",
"name": "storageTemplate"
}