Configure Azure Key Vault firewall#
Security · Key Vault · 2023_03
Key Vault should only accept explicitly allowed traffic.
Description#
By default, Key Vault accept connections from clients on any network. To limit access to selected networks, you must first change the default action.
After changing the default action from Allow
to Deny
, configure one or more rules to allow traffic.
Traffic can be allowed from:
- Azure services on the trusted service list.
- IP address or CIDR range.
- Private endpoint connections.
- Azure virtual network subnets with a Service Endpoint.
If any of the following options are enabled you must also enable Allow trusted Microsoft services to bypass this firewall:
enabledForDeployment
- Azure Virtual Machines for deployment.enabledForDiskEncryption
- Azure Disk Encryption for volume encryption.enabledForTemplateDeployment
- Azure Resource Manager for template deployment.
Recommendation#
Consider configuring Key Vault firewall to restrict network access to permitted clients only. Also consider enforcing this setting using Azure Policy.
Examples#
Configure with Azure template#
To deploy Key Vaults that pass this rule:
- Set the
properties.networkAcls.defaultAction
property toDeny
.
For example:
Azure Template snippet
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2022-07-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"properties": {
"sku": {
"family": "A",
"name": "standard"
},
"tenantId": "[tenant().tenantId]",
"softDeleteRetentionInDays": 90,
"enableSoftDelete": true,
"enablePurgeProtection": true,
"accessPolicies": "[parameters('accessPolicies')]",
"networkAcls": {
"defaultAction": "Deny",
"bypass": "AzureServices",
"ipRules": [],
"virtualNetworkRules": []
}
}
}
Configure with Bicep#
To deploy Key Vaults that pass this rule:
- Set the
properties.networkAcls.defaultAction
property toDeny
.
For example:
Azure Bicep snippet
resource vault 'Microsoft.KeyVault/vaults@2022-07-01' = {
name: name
location: location
properties: {
sku: {
family: 'A'
name: 'standard'
}
tenantId: tenant().tenantId
softDeleteRetentionInDays: 90
enableSoftDelete: true
enablePurgeProtection: true
accessPolicies: accessPolicies
networkAcls: {
defaultAction: 'Deny'
bypass: 'AzureServices'
ipRules: []
virtualNetworkRules: []
}
}
}
Links#
- Public endpoints
- Configure Azure Key Vault firewalls and virtual networks
- Azure security baseline for Key Vault - Disable Public Network Access
- Azure Policies - Azure Key Vault should have firewall enabled
- Azure Key Vault should have firewall enabled
- Trusted services
- Azure deployment reference
Last update:
2023-03-28