DET-A8: Attestation-gated Key Vault key disabled or deleted¶
The Key Vault key the confidential VM releases through Secure Key Release was deleted or disabled (KeyDelete, a key attributes update setting enabled=false, or a management-plane keys/delete). Release breaks, and a replacement key can be stood up without the attested release policy — the Azure analog of DET-12 / DET-C5.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | Azure confidential VMs |
| Group | tee |
| Log source | Azure Key Vault · AuditEvent / Activity Log |
| Policy | P-03 |
| Related | AZURE-SKR-01 |
Fires when¶
Key Vault key disabled (enabled=false) OR deleted AND key IN attested_keys
How it runs¶
untrust detect --platform azure-cvm reads the Activity Log and Key Vault AuditEvent entries, live (with azure-mgmt-monitor and azure-identity installed) or from an exported file passed with --azure-log-file.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.