DET-A6: Key Vault opened to public networks¶
A vault write set its network default action to Allow (public): the vault holding the attestation-gated key is reachable from outside the confidential VM's network.
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Azure confidential VMs |
| Group | cloud |
| Log source | Azure Activity Log · Key Vault |
| Related | AZURE-KV-01 |
Fires when¶
Key Vault write AND publicNetworkAccess Enabled OR networkAcls.defaultAction Allow
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.