Azure Microsoft Defender for Cloud is set to Off for Key Vault misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_87
Category - Subcategory	Monitoring - Alerting And Notifications
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c73d5998-dfa1-4978-a34b-0a48a47c2dce

Impact

Azure Defender is a cloud workload protection service that utilizes and agent-based deployment to analyze signals from Azure network fabric and the service control plane, to detect threats across all Azure resources. It can also analyze non-Azure resources, utilizing Azure Arc, including those on-premises and in both AWS and GCP (once they've been onboarded). Azure Defender detects unusual and potentially harmful attempts to access or exploit Key Vault accounts.

How to Fix

Resource: azurerm_security_center_subscription_pricing

• Arguments: resource_type - (Required) The resource type this setting affects.

Ensure that KeyVaults is declared to pass this check. [source,go]

resource "azurerm_security_center_subscription_pricing" "example" { tier = "Standard" resource_type = "AppServices,ContainerRegistry,KeyVaults,KubernetesService,SqlServers,SqlServerVirtualMachines,StorageAccounts,VirtualMachines,ARM,DNS" }