Pipeline: 9.11 Ensure Azure Key Vaults are Used to Store Secrets
Description
Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.
The credentials given to an application have permissions to create, delete, or modify data stored within the systems they access. If these credentials are stored within the application itself, anyone with access to the application or a copy of the code has access to them. Storing within Azure Key Vault as secrets increases security by controlling access. This also allows for updates of the credentials without redeploying the entire application.
Remediation
Remediation has 2 steps
- Setup the Key Vault.
- Setup the App Service to use the Key Vault.
Step 1: Set up the Key Vault
From Azure CLI
az keyvault create --name "<name>" --resource-group "<myResourceGroup>" --location myLocation
From Powershell
New-AzKeyvault -name <name> -ResourceGroupName <myResourceGroup> -Location <myLocation>
Step 2: Set up the App Service to use the Key Vault
Sample JSON Template for App Service Configuration:
{ "resources": [ { "type": "Microsoft.Storage/storageAccounts", "name": "[variables('storageAccountName')]" }, { "type": "Microsoft.Insights/components", "name": "[variables('appInsightsName')]" }, { "type": "Microsoft.Web/sites", "name": "[variables('functionAppName')]", "identity": { "type": "SystemAssigned" }, "resources": [ { "type": "config", "name": "appsettings", "dependsOn": [ "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]", "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]", "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('storageConnectionStringName'))]", "[resourceId('Microsoft.KeyVault/vaults/secrets', variables('keyVaultName'), variables('appInsightsKeyName'))]" ], "properties": { "AzureWebJobsStorage": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]", "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('storageConnectionStringResourceId')).secretUriWithVersion, ')')]", "APPINSIGHTS_INSTRUMENTATIONKEY": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('appInsightsKeyResourceId')).secretUriWithVersion, ')')]", "WEBSITE_ENABLE_SYNC_UPDATE_SITE": "true" } }, { "type": "sourcecontrols", "name": "web", "dependsOn": [ "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]", "[resourceId('Microsoft.Web/sites/config', variables('functionAppName'), 'appsettings')]" ] } ] }, { "type": "Microsoft.KeyVault/vaults", "name": "[variables('keyVaultName')]", "dependsOn": [ "[resourceId('Microsoft.Web/sites', variables('functionAppName'))]" ], "properties": { "accessPolicies": [ { "tenantId": "[reference(concat('Microsoft.Web/sites/', variables('functionAppName'), '/providers/Microsoft.ManagedIdentity/Identities/default'), '2015-08-31-PREVIEW').tenantId]", "objectId": "[reference(concat('Microsoft.Web/sites/', variables('functionAppName'), '/providers/Microsoft.ManagedIdentity/Identities/default'), '2015-08-31-PREVIEW').principalId]", "permissions": { "secrets": [ "get" ] } } ] }, "resources": [ { "type": "secrets", "name": "[variables('storageConnectionStringName')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]", "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]" ], "properties": { "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', variables('storageAccountName'), ';AccountKey=', listKeys(variables('storageAccountResourceId'),'2015-05-01-preview').key1)]" } }, { "type": "secrets", "name": "[variables('appInsightsKeyName')]", "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults/', variables('keyVaultName'))]", "[resourceId('Microsoft.Insights/components', variables('appInsightsName'))]" ], "properties": { "value": "[reference(resourceId('microsoft.insights/components/', variables('appInsightsName')), '2015-05-01').InstrumentationKey]" } } ] } ]}
Default Value
By default, no Azure Key Vaults are created.
Run the pipeline
To run this pipeline from your terminal:
flowpipe pipeline run azure_cis.pipeline.cis_v300_9_11
Use this pipeline
To call this pipeline from your pipeline, use a step:
step "pipeline" "step_name" { pipeline = azure_cis.pipeline.cis_v300_9_11 }
Params
Name | Type | Required | Description | Default |
---|---|---|---|---|
database | connection.steampipe | Yes | Database connection string. | connection.steampipe.default |
notifier | notifier | Yes | The name of the notifier to use for sending notification messages. | notifier.default |
notification_level | string | Yes | The verbosity level of notification messages to send. Valid options are 'verbose', 'info', 'error'. | info |
approvers | list(notifier) | Yes | List of notifiers to be used for obtaining action/approval decisions. | notifier.default |
Outputs
This pipeline has no outputs.