Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Key Vault RBAC recommendation #479

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+25 −0
Open

feat: Key Vault RBAC recommendation #479

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d8a9657
New Key Vault recommendation for using RBAC
Oct 23, 2024
dec1a50
updating query with correct recommendationId
Oct 23, 2024
f8d1378
Update recommendation description
oZakari Oct 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions azure-resources/KeyVault/vaults/kql/c41fd2c7-fd5e-46e8-97cb-5d0c6954500e.kql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
// Azure Resource Graph Query
// Provides a list of Azure Key Vault resources that do not use RBAC for Data Plane

resources
| where type == "microsoft.keyvault/vaults"
| where isnull(properties.enableRbacAuthorization) or properties.enableRbacAuthorization != true
| extend param1 = 'Role-based access control: Not Configured'
| project recommendationId = "c41fd2c7-fd5e-46e8-97cb-5d0c6954500e", name, id, tags, param1
17 changes: 17 additions & 0 deletions azure-resources/KeyVault/vaults/recommendations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,3 +82,20 @@
learnMoreLink:
- name: Azure Key Vault logging overview
url: "https://learn.microsoft.com/azure/key-vault/general/logging?tabs=Vault"

- description: 'Integrate Azure Key Vault RBAC for Data Plane with Azure RBAC, replacing the legacy access model.'
aprlGuid: c41fd2c7-fd5e-46e8-97cb-5d0c6954500e
recommendationTypeId: null
recommendationControl: Other Best Practices
recommendationImpact: High
recommendationResourceType: Microsoft.KeyVault/vaults
recommendationMetadataState: Active
longDescription: |
Azure Key Vault for Data plane offers Unified Access Control, Centralized Access Management, Improved Security, Integration with Privileged Identity management and specific Deny Assignments.
potentialBenefits: Improved RBAC controls
pgVerified: true
automationAvailable: false
tags: null
learnMoreLink:
- name: Provide Key Vault access with an Azure role-based access control
url: "https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli"