Homepage
About Snyk

Key Vault logging is not enabled Affecting Monitor service in Azure

Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    Logging / Audit

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Azure HIPAA ISO-27001 NIST-800-53 SOC-2
  • Snyk ID SNYK-CC-00689
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Enable audit logging for key vault instances to ensure interactions with key vaults are logged and available.

How to fix?

Enable AuditEvent logging for key vault instances to ensure interactions with key vaults are logged and available set properties.logs.category to AuditEvent and properties.logs.enabled to true.

Example Configuration

{
    "type": "Microsoft.Insights/diagnosticSettings",
    "apiVersion": "2021-05-01-preview",
    "name": "diagnostic-a1-689",
    "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', 'example-keyvault1-689')]",
        "[resourceId('Microsoft.Storage/storageAccounts', 'examplestorage1689')]"
    ],
    "scope": "[resourceId('Microsoft.KeyVault/vaults', 'example-keyvault1-689')]",
    "properties": {
        "logs": [
            {
                "category": "AuditEvent",
                "enabled": "true",
                "retentionPolicy": {
                        "days": "180",
                        "enabled": "true"
                }
            }
        ],
        "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', 'examplestorage1689')]"
    }
}