Azure Key Vault is not recoverable misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_42
Category - Subcategory	Storage - Backups
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	045f2c23-66af-40ef-a0cf-e04f5cda9843

Impact

The key vault contains object keys, secrets and certificates. Accidental unavailability of a key vault can cause immediate data loss or loss of security functions supported by the key vault objects, such as authentication, validation, verification, and non-repudiation. Deleting or purging a key vault leads to immediate data loss as keys encrypting data, including storage accounts, SQL databases, and/or dependent services provided by key vault objects, such as keys, secrets, and certificates. We recommended you make the key vault recoverable by enabling the Do Not Purge and Soft Delete functions. This will prevent accidental deletion by a user running the delete/purge command on the key vault, or an attacker/malicious user does to deliberately to cause disruption.

How to Fix

Resource: azurerm_key_vault

• Arguments: soft_delete_enabled + purge_protection_enabled [source,go]

---

resource "azurerm_key_vault" "example" { ...

• purge_protection_enabled = true
• soft_delete_retention_days = 7 # Default is 90 }

---