Configure Azure Key Vault firewall

Security · Key Vault · 2023_03

Key Vault should only accept explicitly allowed traffic.

Description

By default, Key Vault accept connections from clients on any network. To limit access to selected networks, you must first change the default action.

After changing the default action from Allow to Deny, configure one or more rules to allow traffic. Traffic can be allowed from:

• Azure services on the trusted service list.
• IP address or CIDR range.
• Private endpoint connections.
• Azure virtual network subnets with a Service Endpoint.

If any of the following options are enabled you must also enable Allow trusted Microsoft services to bypass this firewall:

• enabledForDeployment - Azure Virtual Machines for deployment.
• enabledForDiskEncryption - Azure Disk Encryption for volume encryption.
• enabledForTemplateDeployment - Azure Resource Manager for template deployment.

Recommendation

Consider configuring Key Vault firewall to restrict network access to permitted clients only. Also consider enforcing this setting using Azure Policy.

Examples

Configure with Azure template

To deploy Key Vaults that pass this rule:

• Set the properties.networkAcls.defaultAction property to Deny.

For example:

Azure Template snippet

{
  "type": "Microsoft.KeyVault/vaults",
  "apiVersion": "2022-07-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "properties": {
    "sku": {
      "family": "A",
      "name": "standard"
    },
    "tenantId": "[tenant().tenantId]",
    "softDeleteRetentionInDays": 90,
    "enableSoftDelete": true,
    "enablePurgeProtection": true,
    "accessPolicies": "[parameters('accessPolicies')]",
    "networkAcls": {
      "defaultAction": "Deny",
      "bypass": "AzureServices",
      "ipRules": [],
      "virtualNetworkRules": []
    }
  }
}

Configure with Bicep

To deploy Key Vaults that pass this rule:

• Set the properties.networkAcls.defaultAction property to Deny.

For example:

Azure Bicep snippet

resource vault 'Microsoft.KeyVault/vaults@2022-07-01' = {
  name: name
  location: location
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenant().tenantId
    softDeleteRetentionInDays: 90
    enableSoftDelete: true
    enablePurgeProtection: true
    accessPolicies: accessPolicies
    networkAcls: {
      defaultAction: 'Deny'
      bypass: 'AzureServices'
      ipRules: []
      virtualNetworkRules: []
    }
  }
}

Links

• Public endpoints
• Configure Azure Key Vault firewalls and virtual networks
• Azure security baseline for Key Vault - Disable Public Network Access
• Azure Policies - Azure Key Vault should have firewall enabled
• Azure Key Vault should have firewall enabled
• Trusted services
• Azure deployment reference

---

Last update: 2023-03-28

Comments